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“No personal information shall be col- 
lected... unless it relates directly to an 
operating program or activity ...”. 


“A government institution shall, where- 
ever possible, collect personal informa- 
tion... directly from the individual to 
whom it relates... 


“... Shall inform any individual... ofthe 
purpose for which the information is 
being collected. 


“... Shall take all reasonable steps to 
ensure that personal information ...is as 
accurate, up-to-date and complete as 
possible. 


“Personal information... shall not, with- 
out the consent of the individual to 
whom it relates, be used... except 


(a) for the purpose for which the infor- 
mation was obtained or compiled...” 


(or in accordance with specific exceptions 
set out in section 8) 


The Privacy Act 
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The Honourable Guy Charbonneau 
The Speaker 

The Senate 

Ottawa 


June 30, 1989 


Dear Mr. Charbonneau: 


| have the honour to submit to Parliament my annual report. This report covers 
the period from April 1, 1988, to March 31, 1989. 


Yours sincerely, 


pfs Sere O, 


John W. Grace 
Privacy Commissioner 
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The Honourable John Fraser, P.C., Q.C., M.P. 
The Speaker | 

The House of Commons 

Ottawa 


June 30, 1989 


Dear Mr. Fraser, 


| have the honour to submit to Parliament my annual report. This report covers the 
period from April 1, 1988 to March 31, 1989. 


Yours sincerely, 


yf. Grace 


John W. Grace 
Privacy Commissioner 
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Mandate 


The Privacy Act provides individuals 
with access to their personal informa- 
tion held by the federal government; it 
protects individuals’ privacy by 
limiting those who may see the infor- 
mation; and it gives individuals some 
control over the government’s collec- 
tion and use of the information. 


The Act sets out the principles of fair 

information practices, requiring 

government to: 

@ collect only the information needed 
to operate its programs; 

® collect the information directly from 
the individual concerned, whenever 
possible; and 

@ tell the individual how it will be 
used; 

@ keep the information long enough 
to ensure an individual access; and 

e “take all reasonable steps” to 
ensure its accuracy and complete- 
ness 


Individuals in Canada may complain to 

the Privacy Commissioner If: 

e@ they are denied any part of the 
information; 


@ they are denied their request to cor- 


rect some of the information on the 
file — or their right to annotate it; 

e the department takes longer than 
the initial 30 days or maximum 60 
days to provide the information; 

e the Personal Information Index 
description of the contents of the 
information bank is deficient in 
some way; 

® the department's listing in the Index 
does not describe all the uses it 
makes of personal information; 


® an institution is collecting, keeping, 
using or disposing of personal infor- 
mation in a way which contravenes 
the Privacy Act. 


The Privacy Commissioner’s investi- 
gators examine any file (including 
those in closed banks) except confi- 
dences of the Queen’s Privy Council 
to ensure that government institutions 
are complying with the Act. 


~The Act also gives the Privacy Com- 


missioner the power to audit the way 
government institutions are collecting, 
using and disposing of personal 
information. 


A Mixed Review 


The measure of a year’s results in the 
privacy business can be as variable as 
the standards used for the calculation. 
It may even be fraudulent to attempt to 
sum up the privacy state of the nation 
with catchy generalizations. The sub- 
ject is now simply too complex to be 
reduced to neat themes. 


Even the Supreme Court of Canada 
mixed the results. Here was a year in 
which the court pronounced in Her 
Majesty the Queen v. Brandon Roy 
Dyment that “privacy is essential for 
the well-being of the individual” and 
the “restraints imposed on government 
to pry into the lives of the citizens go to 
the essence of a democratic state’. The 
message could not be clearer or the 
source more definitive. 


Here the court was re-inforcing its 
earlier opinion that the protection of 
“individuals from unjustified intrusions 
upon their privacy” is established by 
section 8 of the Charter of Rights and 
Freedoms (“everyone has the right to 
be secure against unreasonable search 
and seizure”). The judgment in the 
Dyment case, written by Mr. Justice G. 
V. La Forest, also set forth the follow- 
ing key principle: “If the privacy of the 
individual is to be protected, we cannot 
wait to vindicate it only after it has 
been violated..../nvasions of privacy 
must be prevented and, where privacy 
is outweighed by other societal claims, 
there must be clear rules setting forth 
the condition in which it can be 
violated.” 


The Privacy Act is precisely a com- 
pendium of such rules. In two:cases 
now, the Supreme Court has given the 
Privacy Act the strongest possible 
constitutional underpinning, making 
explicit the application of section 8 of 
the Charter to privacy protection. 


Parliament can take some satisfaction 
in being ahead of both the Charter and 
the Supreme Court in having estab- 
lished by the Privacy Act the rules to 
control government uses of personal 
information collected from its citizens. 
Parliament is not always thus in 
advance of the courts in these litigious 
days. 


But the privacy news from the legal 
front does not bring unalloyed joy. The 
Supreme Court of Canada’s decision in 
Stewart v. Her Majesty the Queen 
appears to set back the cause. In this 
case, the court ruled that confidential 
information cannot be stolen because it 
cannot be considered property for the 
purpose of the Criminal Code. 


In the case, a union, attempting to form 
a bargaining unit at a hotel, was unable 
to obtain the names and addresses of 
some 600 employees because man- 
agement treated this information as 
confidential. A consultant hired by the 
union obtained the list through a secu- 
rity guard who, for a fee, copied the 
names from a list on the hotel’s prem- 
ises without removing, or in any way 
altering, the original document. The 
consultant was charged under the 
Criminal Code with counselling to 
commit fraud, theft and mischief to the 
private property of the hotel and its 
employees. 


The Ontario Court of Appeal’s convic- 
tion was overturned by the Supreme 
Court (in a unanimous decision). Mr. 
Justice Antonio Lamer wrote for the 
court that “confidential information is 
not of a nature such that it can be 
taken because if one appropriates 
confidential information without taking 
a physical object, for example by 
memorizing or copying informa- 
tion...the alleged owner is not deprived 
of the uses or possession thereof’. The 
judgment went on to observe that “one 
cannot be deprived of confidentiality 
because one cannot own 
confidentiality”. 


With great respect, as lawyers ritu- 
alistically intone, these observations 
have alarming implications for the 
information society in general and the 
Privacy Act in particular. If the Privacy 
Act promises anything, it is the promise 
of protection for the confidentiality of 
personal information collected by 
government institutions. That fine legal 
point of whether one can own confi- 
dentiality is simply irrelevant to the 
important business of keeping sensitive 
information confidential. 


_ If this non-lawyerly reading of the 
court’s decision is correct, insufficient 
weight was given to the significant 
injury which can occur through unau- 
thorized access to huge amounts of 
sensitive personal information held by 
both government and the private sector. 


While possible commercial harm 
seemed uppermost, perhaps exclu- 
sively, in the mind of the court, terrible 
personal tragedy could be the result of 
the unauthorized disclosures of Royal 
Canadian Mounted Police investigation 
records, Canadian Security and Intelli- 
gence Service surveillance reports, 
Health and Welfare medical files — to 
stay with government. 


Yet, the court seems to have said that 
records could be memorized — or 
copied (or photographed?) — without 
any criminal sanctions as long as 
documents are not physically 
appropriated. 


Stewart v. Her Majesty the Queen did 
not receive the public attention it 
deserved. Had the information been 
sensitive health or financial records 
and not a mere list of names involved 
in a commonplace labor dispute, the 
Outcry would have been enormous — 
and deservedly so. 


The Privacy Act contains no sanctions. 
Until this Supreme Court decision, a 
theft conviction under section 298(1) of 
the Criminal Code or a fraud convic- 
tion under section 328(1) seemed 
detterent enough. Thus it has seemed 
unnecessary to argue for a sanction 
provision in the Privacy Act. Now the 
assumed Criminal Code support has 
been removed. 


True, a breach of trust offence remains. 
It was the charge successfully prosecu- 
ted in the case of the Revenue Canada 
employee who stole the income tax 
records of some 16 million persons 
from a Toronto office of Revenue 
Canada. However, this offence would 
not be relevant in situations where 
confidential personal information is 
taken by a non-public servant or is elic- 
ited by deceit from a public official. 


Shortly after the decision was delivered 
in Stewart v. Her Majesty the Queen, 
the Privacy Commissioner raised his 
concerns with the then Minister of 
Justice, the Honourable Ray Hnatys- 
hyn. The Minister felt that, despite the 
Supreme Court’s decision, the Criminal 
Code would continue to deter the 
improper disclosure of information by 
public officials. He reiterated the 
government’s commitment to amend 
the Privacy Act to provide a statutory 
basis for the security standards now 
contained in the Security Policy of the 
Government of Canada. The Minister 
noted 1985 amendments to sections 
301.2 and 387(1.1) of the Criminal 
Code which created offences dealing 
with the integrity of computer systems 
and services and which protect compu- 
terized data including personal 
information. 


However, there continues to be a gap 
in the law which Parliament should 
close because significant amounts of 
personal information are held by 
government in paper files and since 
compromise of such information by 
outsiders cannot be ruled out. 


The Supreme Court concluded in 
Stewart v. Her Majesty the Queen that 
Parliament and not the courts should 
decide what protection be given to 
confidential information. Parliament 
needs to act upon that invitation and 
protect the integrity of the 

Privacy Act. 


In passing that Act, Parliament made 
an explicit commitment to Canadians 
that the confidentiality of their personal 
information heid by government would 
be respected. That is the bedrock upon 
which this legislation rests. If confiden- 
tial information can be appropriated 
with no fear of sanction because “one 
cannot own confidentiality” then the 
promise Parliament made in the Pri- 
vacy Act has been, at the least, 
seriously eroded. 


“Owning” confidentiality could be 
enormously more important than 
owning physical objects. They, after all, 
can be replaced. But the loss of privacy 
is non-renewable. Its loss is nothing 
less than losing control, a diminishing 
of human dignity. 


Hold the Applause 


If it was a good news, bad news privacy 
year from the Supreme Court, so it was 
from government. The fairest measure 
of the government’s performance is to 
test it against its own key commitments 
and timetable set out in The Steps 
Ahead, which was issued in 1987 in 
response to the unanimous recom- 
mendations of the Justice and Solicitor 
General Committee. That entirely re- 
assuring document was greeted in this 
report last year with something of the 
reverence that the Ten Commandments 
received at Mount Sinai. When put in 
place, it was said, the new policies and 
proposed amendments to the Privacy 
Act would make Canada’s third- 
generation privacy legislation “as good 
as any in the world”. 


6c 


The government’s “plan of action” cal- 
led for achieving all its goals by the end 
of 1988. Specific commitments were 
made: “begin immediately” the process 
of bringing Crown corporations under 
the Privacy Act; establish the Personal 
Information Index (the guidebook to 
the government’s holdings of personal 
information) as a data base and to 
make it available in machine-readable 
form. The processes may have begun, 
but more than a year later these com- 
mitments had not been realized. 


Other target dates were not met. Direc- 
tives covering consultation with the 
Privacy Commissioner on issues with 
data protection implications were to 
have been issued by spring, 1988. 
Amendments to the Privacy Act, 
including the promised statutory basis 
for information security standards, 
were to be introduced by the fall of 
1988. A public education program on 
behalf of the Privacy Act was to be in 
place by winter, 1988. Not only were 
the dates missed, nothing had occur- 
red in these matters as of March 31, 
1989. 


Of course, these were self-imposed 
deadlines. Under-estimating implemen- 
tation difficulties because of over- 
enthusiasm should not be too much 
faulted. Besides, some key commit- 
ments were made good, if somewhat 
later than promised. The will to pro- 
ceed with the unfinished business 
appears generally strong. 


But the sluggishness and the slippages 
are disappointing. 


The next 12 months will demonstrate 
whether The Steps Ahead will be mean- 
ingful or largely an empty metaphor. 
Will the walk in The Steps Ahead turn 
out to be a stroll in the park? In the pri- 
vacy business today, the Queen’s coun- 
sel in Lewis Carrol’s Through the Look- 
ing Glass should be the guide: 


“Now, here, you see, it takes all the 
running you can do, to keep in the 
same place. If you want to get 
somewhere else, you must run at 
least twice as fast as that”. 


Two Steps Forward 


In last year’s annual report, the 
government was congratulated for 
making good on two commitments — a 
new policy controlling the govern- 
ment’s own use of the Social Insurance 
Number (SIN) and new controls on the 
matching or linking of unrelated data 
bases. Alas, the government’s pace did 
not match the Privacy Commissioner's 
enthusiasm. Though the SIN and data 
matching policies were announced 
earlier, final approval was given only in 
April, 1989 — technically outside this 
reporting year. 


Yet, the cliché “better late than never” 
is appropriate in this case. A year’s 
delay does not take away from the 
significance of the accomplishment. 
The data matching controls were de- 
scribed here extensively last year. 


The tough new restrictions on the 
government’s own uses of SIN are 
worth revisiting; they represent the 
most significant of the major commit- 
ments on which the government has 
made good. The President of the Trea- 
sury Board put the issue precisely: 


“Many Canadians feel threatened by 
the use of the Social Insurance Num- 
ber as a universal identifier. With the 
rapid development of computer 
technology, there is a growing concern 
that the SIN may be misused for linking 
personal information in ways that may 
pose a threat to individual privacy”. 


Thus was announced the “first step by 
the government” to cap its collection 
and use of the SIN. A large number of 
existing uses of the number are to be 
eliminated over five years and from 
now on any proposed new collection of 
the SIN for administrative purposes, 
other than an existing, approved list, is 
to be sanctioned by Parliament itself. 


The new policy stands up against every 
natural bureaucratic urge in the public 
and private sector. It is the first time 
any government has attempted to roll 
back the use of its own numerical iden- 
tifier. Omelettes are more easily and 
less expensively unscrambled (the esti- 
mated cost of $16 million may be low). 
But it’s being done! 


No more will the SIN be a public ser- 
vant’s principal employee number; the 
armed forces lose the SIN as the mili- 
tary service number. Applicants for 
permanent residence in Canada will 
not come with a SIN, nor will appli- 
cants for citizenship be required to 
submit to a SIN. 


Commercial fishermen seeking per- 
mits, taxpayers applying for fuel tax 
rebates, candidates for grants and fel- 
lowships — all these and others are set 
free from the usages of the SIN. | 


It is something of a paradox that an 
age which has all but lost the concept 
of sin has so come under the sway of 
SIN. Babies have been given a SIN as a 
birth registration number in Prince 
Edward Island and some funeral direc- 
tors are said to ask for the SIN of the 
deceased: thus SIN from cradle to 
grave; SIN even unto death. 


In putting its own house in order, the 
federal government has new moral as 
well as legal authority to make good on 
yet another warning issued to other 
levels of government and the private 
sector. Continued mindless and in- 
sensitive demands for the SIN invite 
legislation — and that would be 
deserved. 


...A Step Back 


Just three months after the announce- 
ment of an enormously encouraging 
policy to control the SIN, Parliament 
passed amendments to the Income Tax 
Act, among which required Canadians 
to disclose their SINs to financial insti- 
tutions where there had been no such 
compulsion before. Suddenly, even a 
bank account couldn't be opened 
without a SIN. 


The new policy was designed to facili- 
tate the reporting of interest income to 
Revenue Canada, an almost noble pur- 
pose. Unfortunately, little or no effort 
was made to notify the public in 
advance of the purpose of this new col- 
lection and use of SIN. 


Despite government’s promise to 
consult the Privacy Commissioner in 
initiatives affecting privacy, no consul- 
tation was undertaken before the legis- 
lation was introduced. The efficiency of 
tax collection was accepted by the 
government as justifying a new use of 
the SIN without any apparent consid- 
eration of the inherent privacy dangers. 


In the complexity and detail of the 
amendments to the /ncome Tax Act, 
the extension of the SIN and its signi- 
ficance was missed by members of 
Parliament, the media and, yes, the 
Privacy Commissioner’s Office. One 
simply did not expect such legislation 
to contain anything of interest to the 
business of privacy protection. Of 
course, the fact that it did demon- 
strates the vulnerability of privacy to 
assault from the most unexpected 
quarters. 


The provisions in the new /ncome Tax 
Act amendments have, for the first 
time, made it a punishable offence to 
refuse to provide a SIN. Government 
institutions have had by statute and 
regulation the authority to demand 
SINs, mainly for such social programs 
as unemployment insurance and pen- 
sions. (No number, no coverage, no 
benefits). Now, no number and a $100 
fine. (What happens for refusing to pay 
the fine is not clear. Two days in jail?) 


Another precedent is established here. 
Until these income tax amendments, 
Canadians were required by law to give 
their SINs only to the federal govern- 
ment. Now they must confess their 
SINs to banks, trust companies, stock- 
brokers, credit unions, whenever and 
wherever they make what looks like an 
interest-bearing investment. Welcome 
to the computer society. 


Of course, taxes should be paid. There 
is a relentless consistency in applying 
the new law once the $1,000 interest 
deduction was abolished. But the 
implications of the new demands for 
the SIN with the penalty for failure to 
comply are much more sweeping than 
anyone appears to have realized. The 
pity is that no one thought to ask or 
even to explain. 


So soon after announcing the admi- 
rable policy to restrict the government's 
use of the SIN, thousands of private 
sector institutions (consider the num- 
ber of bank branches alone!) are 
authorized to maintain new records - 
systems with the SIN as the identifier. 
The fact that there is a fine of $5000 for 
misusing the SIN is small consolation. 


...and Another 


In The Steps Ahead, the government 
committed itself to extending the juris- 
diction of the Privacy Act to cover 
Crown corporations and their subsid- 
iaries. Such action would almost dou- 
ble the number of institutions covered 
and, most important, would give visible 
leadership to the private sector. In 
implementing the fair information prac- 
tices, the government was putting its 
own full house in order. 


Since many of these Crown corpora- 
tions are in direct competition with pri- 
vate sector companies, the coverage by 
the Privacy Act conveys the strong 
message that the government believes 
data protection can be a complement, 
not an obstacle, to good business. 
Canada Post, after all, has been subject 
to the legislation for five years and in 
the face of significant competitive 
pressures finds that life under the 
Privacy Act does not hinder it 
commercially. 


Though the bulk of the Crown corpora- 
tions may yet be covered (members of 
the Privacy Commissioner’s Office trav- 
elled as part of an awareness task 
force, meeting representatives of some 
21 corporations), two significant omis- 
sions, as well as the general delay, have 
marred the government’s initiative. 
Neither Air Canada nor Petro-Canada 
were included on the list of institutions 
to be brought under the Privacy Act. 


Air Canada has been exempted 
because it no longer is a wholly-owned 
government creature — a dubious 
ground indeed because the govern- 
ment continues to maintain majority 
ownership, whatever the future may 
bring. That itself is reason to hold the 
government to its original pledge. It 
would be a dangerous precedent in this 
age of privatization if mixed ownership 
were enough to exempt Crown corpo- 
rations from federal legislation. Until 
now, it has not. Air Canada itself 
remains subject to the Official Lan- 
guages Act and, presumably, it would 
even if it were to be completely priva- 
tized. Surely the privacy rights of Air 
Canada’s customers and employees 
are as important as their linguistic 
rights. 


Other western democracies have rec- 
ognized the need to bring under data 
protection codes the vast amount of 
personal information held in the com- 
puters of air carriers. If British Airways 
can live with the United Kingdom's data 
protection legislation, Air Canada 
should be able to live with the 

Privacy Act. 


With Petro Canada, ownership is not 
the issue; Petro Canada is a Crown 
corporation, pure and simple. But cor- 
poration’s management has resisted 
the Privacy Act because of perceived 
difficulties with its operations if it had 
to live within the Act’s principles. 


Perhaps Petro Canada’s life would be 
made easier if, for example, the credit 
files of its customers or lessees did not’ 
have to be opened up to those cus- 
tomers or lessees, as they would have 
to under the Privacy Act. Being held 
exempt from the more onerous 
demands of human rights or employ- 
ment equity laws would also make 
Petro Canada’s life easier. But there is 
no chance of such exemptions. The 
argument for the legal protection of the 
privacy rights of Petro Canada’s 
employees and customers is at least as 
strong. | 


If such high-profile institutions as Air 
Canada and Petro Canada were both to 
be excused from the Privacy Act, the 
government would be rightly viewed as 
undercutting its own commitments. 
Almost every institution, public or pri- 
vate, can conjure up reasons to be 
made exempt from oversight legislation 
— privacy or otherwise. 


Via Rail could object to the Privacy Act, 
so could the Canadian Broadcasting 
Corporation. Yet both of these institu- 
tions (the CBC with some special pro- 
visions to protect its news gathering 
activities) are to be covered. 


There may seem to be an air of blissful 
Or naive unreality to a plea to bring two 
Crown corporations under the Privacy 
Act when the entire private sector, 
including federally-regulated compa- 
nies, operates outside the Act. Why 
worry about Air Canada when other 
Canadian airlines fly the friendly skies 
unimpeded by the binding rules of fair 
information practices? Why insist that 
the customers of Petro Canada be 
given the benefits of the Privacy Act 
while those of all its competitors are 
left to fend for themselves? 


Two more institutions in or out of the 
Privacy Act wiil not make much dif- 
ference to the overall standard of pri- 
vacy protection in the country. But if 
government doesn’t insist that its own 
creatures obey the privacy rules of the 
road, the private sector is not going to 
be impressed by preachments to adopt 
codes such as the data protection prin- 
ciples of the Organization for Econo- 
mic Co-operation and Development 
(OECD). 


Self Regulation? 


All of which raises the effectiveness of 
the government’s effort to encourage 
private sector firms to respect those 
OECD guidelines to which Canada is 
signatory. The Minister of External 
Affairs’ request to major companies to 
implement these guidelines in their 
Organizations does not appear to have 
brought any discernible results. 


The federal government met on two 
occasions with provincial governments 
to develop strategies to encourage the 
private sector to accept and enforce 
the guidelines. However, no agreement 
has apparently been reached as to 
what business sectors are to be target- 
ted or the strategies to be devised. 


The government needs a more vigor- 
Ous approach. That is the least it can 
do in light of its rejection of the unani- 
mous recommendation of the Standing 
Committee on Justice and the Solicitor 
General that the entire federally- 
regulated private sector be made sub- 
ject to the Privacy Act. 


That recommendation was not accept- 
ed (a decision which the Privacy 
Commissioner supported) because 
self-regulation seemed to be the prefer- 
red way to travel in a time when de- 
regulation is in fashion. There have 
been faint stirrings towards self- 
regulation and there was no evidence 
of endemic or widespread abuses. 
Moreover, could a single privacy law be 
constructed to cover the diversity of 
the private sector — from banks to 
cable television companies? Perhaps 
not. There are practical limits to enfor- 
ceable regulation in the age of micro- 
computers. A swollen Privacy Commis- 
sioner’s Office with brigades of 
inspectors would give even privacy a 
bad name. 


Self-regulation will be for most, includ- 
ing the Privacy Commissioner, the pre- 
ferred option to government regulation. 
Recent “second generation” data pro- 
tection laws (Ireland, Australia and 
Japan all adopted legislation within the 
past 12 months) have been much 
closer to Canada’s model than to the 
“first generation” laws of Sweden and 
France which covered the private sec- 
tor. Without more evidence of effective 
self regulation, however, the supporters 
of voluntary data protection codes will 
be increasingly hard put to defend their 
position. 


Who’s in Control Here? 


The demands for personal data con- 
tinue to grow exponentially and 
unchecked. Arthur Miller, who teaches 
law at Harvard University, says that his 
ability to fly depends not on the fact 
that he is standing at an airport counter 
waving a ticket. So far as the airline is 
concerned, unless the right numbers 
come up on a computer, “I do not exist. 
| am a mere three-dimensional version 
of the two-dimensional screen”. Let Mr. 
Miller continue: 


“It’s not just an airline reservations 
system. It has my name. It has my 
telephone number. It has my credit 
card number. It has who I’m flying 
with. Whether I’ve got hotel reserva- 
tions or a car rental through the sys- 
tem...that’s a dossier, and | know it.” 


And there are more dossiers. Arrive at 
a hotel and, he says, “you’re not going 
to lay your head down on a Sheraton 
pillow unless its computer recognizes 
you. You put it all together and you 
realize that your life is controlled by 
one data bank after another, made pos- 
sible by the computer.” 


It is a price for convenience and effi- 
ciency. No one is suggesting smashing 
the computers. But ground rules for 
the handling of the vast amount of per- 
sonal information being collected 
should be put in place and respected. 
Data collections are available, on 
command, for making the important 
decisions about us. Arthur Miller is 
right: 


“We have come to understand that it 
is impossible to get insurance, to get 
credit, to get certain jobs, get certain 
government benefits without going 
through record clearance and record 
approbation — that people will be 
looking through our files. Who they 
are, we don’t know. Where they are, 
we do not know. What the criteria for 
decision-making might be, we do 
not know.” 


We do know (or should!) that informa- 
tion about us in computers can be 
wrong. But without privacy legislation 
or working, effective voluntary codes, 
there is no opportunity to see and cor- 
rect one’s file. Without privacy legisla- 
tion or enforced codes, there is nothing 
to stop the frightening growth industry 
in the sale and exchange of computer- 
ized personal information, of data 
chronicling personal consumption 
habits (traced through credit card 
transactions and direct mail orders) and 
charitable or political contributions. 


Who’s in control here? Is it individuals 
of their own information? Or is it per- 
sonal information collectors and 
traders with their marvelous machines? 
To become a “data subject” should not 
mean becoming any less a human 
being. Should that ever be conceded, 
civilization has become subject to its 
machines and our information societies 
will have evolved, as Professor David 
Flaherty of the University of Western 
Ontario has warned, into “surveillance 
societies”. 


Professor Flaherty, an internationally- 
recognized authority on privacy and 
data-protection laws, put it in almost 
apocalyptic terms: 


“The various automated data bases 
now in existence make possible 
fairly integrated monitoring of indi- 
viduals in Western countries. The 
proliferation of such information 
banks in both the public and private 
sectors, rather than the existence of 
any single one of them, poses the 
fundamental challenge to privacy 
interests. We need to think about the 
implications of such surveillance 
practices for the protection of 
human rights. In North America in 
particular, the application of infor- 
mation technology is galloping 
ahead of regulation and control”. 


Stripped of one’s power to control what 
the world knows about oneself is 
demeaning and dehumanizing. There is 
nothing fringe or dilletantish about 
claiming privacy rights. They go to the 
heart of human integrity, of dignity and 
the kind of society we want. This is 
why privacy matters. 


Privacy matters most of all between 
citizens and governments because the 
state has enormous power to extract 
and use personal information. 


Yet, a privacy concordat covering the 
marketplace is becoming almost as 
important. Even when personal infor- 
mation is voluntarily given (in many 
transactions there is precious little 
voluntariness, e.g., an application for 
credit), well-defined rules have become 
essential if individuals are to have at 
least residual control over the uses of 
such information. 


Some privacy experts, including Pro- 
fessor Flaherty, have come to believe 
that it is now too late for volunteer pri- 
vacy concordats in the private sector. 
They argue that only legislation can 
control the powerful new technologies 
and give personal information at least a 
minimal level of protection. Back to 
battalions of privacy inspectors and 
very red bureaucratic tape! 


Another privacy scholar, Professor 
James Rule of the State University of 
New York, advocated recently that the 
best way to protect informational pri- 
vacy is by giving individuals a copy- 
right interest in the commercial use of 
their own personal data. Information 
could not be sold or exchanged for 
value without an individual’s permis- 
sion. An ingenious, fascinating, even 
logical concept, though highly improb- 
able and unenforceable. 


These are desperate solutions, born of 
frightful visions. Surely there exists a 
middle way. 


The voluntary rules of the privacy road 
such as the OECD guidelines are en- 
tirely sensible and, if implemented, 
offer some reasonable reassurances. 
But it has become time for government 
to treat volunteering in this business 
much as “volunteers” are traditionally 
found in the armed forces. 


Federally-regulated firms, which the 
Parliamentary Committee recommend- 
ed unanimously should be made sub- 
ject to the Privacy Act, would be the 
place to start. In addition to pursuing 
more vigorously a cooperative strategy 
with the provinces to encourage volun- 
tary compliance with the OECD privacy 
guidelines, the Government of Canada 
should take on the federally-regulated 
private sector in a second front of pri- 
vacy protection activity. Develop effec- 
tive privacy codes, within a specified 
time, they should be told, make them 
known to your customers and 
employees (who will be delighted!) or, 
yes, face legislation. 


The proponents of privacy laws for the 
private sector are right about one thing 
— gentle exhortation has not much 
worked. But better first to turn the 
screw a little than impose the heavy 
apparatus of legislated privacy 
protection. 


Dial Bell for Data 


The Privacy Commissioner has not 
been merely watching these issues 
from the sidelines, content simply to 
grade the government's performance. 
He stepped into the fray upon learning, 
last November, that the Canadian 
Radio-Television and Telecommunica- 
tions Commission was examining 
whether, to whom and under what 
conditions, Bell Canada could sell its 
telephone directory data base of white 
and yellow page subscriber listings in 
machine readable form. The initiative 
was not Bell Canada’s but that of com- 
panies who have been eyeing Bell’s 
data base with some envy. 


This proposal offers chapter and verse 
on how real the pressure is for the 
massive exchanges of computerized 
personal information. At the same time, 
it is a textbook example of how a sensi- 
tive regulatory agency should be alertly 
aware of the stakes. 


In a nice understatement, the CRTC 
noted that “the provision of this infor- — 
mation in machine-readable form may 
heighten concerns related to customer 
privacy”. “Heighten”, indeed! Though 
nothing is more public than a tele- 
phone book, there are good reasons 
why phone customers should be wor- 
ried. The Privacy Commissioner put 
them forward in a formal intervention 
which asked the CRTC not to require 
Bell Canada to offer its directories data 
base to anyone willing to buy. 


The reason is this: a qualitative change 
takes place when names, addresses 
and phone numbers are moved 

from paper listings to electronic data 
processing disks. Special privacy 
dangers arise because of the infinitely 
greater accessibility, transmitability and 
transformability (even the words are 
Ominous) of data in machine readable 
form. And nothing is closer to home 
than a telephone book. 


One company has already transferred 
to a 4.7 laser disk the names, addresses 
and phone numbers of 7.9 million of 
Canada’s 8.5 million households. It was 
a slow, expensive (more than $1 
million, and this in Pakistan) job. 


The phone book was only the start. 
The same laser disk includes the co- 
ordinates of each household to within 
one meter on a grid map of Canada, 
the names of neighbours, electoral dis- 
tricts, the length of time the occupant 
has been at that address. Information 
from 12 demographic fields (sold in 
aggregated form by Statistics Canada) 
offers census data as to probabilities of 
income, language, religion and chil- 
dren. All this is information in the 
public domain. But add credit card or 
banking information, if such informa- 
tion was to made available by fair 
means or foul, and the result is profil- 
ing of the population on a mass, sys- 
tematic scale. 


It is a marketer's dream — a privacy 
nightmare. Machine-readable listings 
mean that personal information can be 
manipulated in any number of creative 
ways for telephone or mail soliciting. 
Yet, that would be an almost benign 
use. Such listings also provide a moni- 
toring or tracking tool of interest not 
only to marketers but to criminals and, 
yes, law enforcement agencies alike. 


Phone subscribers never dreamed of, 
much less consented to, this degree of 
privacy invasion just by the fact of 
being listed in the telephone directory. 
Technology makes the danger real and 
present. 
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AIDS and Privacy 


On another front, and as promised in 
last year’s annual report, the Privacy 
Commissioner developed recommen- 
dations to ensure that AlDS-related 
personal information is handled by the 
federal government in accordance with 
the letter and spirit of the Privacy Act. 
The resulting report, entitled A/DS and 
the Privacy Act, confirms that an 
appropriate national response to AIDS 
is perhaps the most sensitive and an- 
guished privacy issue of our time. A/DS 
and the Privacy Act seeks an elusive 
balance between protecting the privacy 
of those either with AIDS or infected 
with the HIV (the virus that causes 
AIDS), and appropriate disclosures 
which the protection of others 
demands. 


Compassion towards those afflicted 
demands that they are protected from 
the further trauma of unnecessarily 
invading their private lives and disclos- 
ing their condition. The diagnosis of 
AIDS continues to be a sentence to 
death. In fact, some current opinion 
suggests that simply carrying the HIV 
virus also means early death. 


Unthinking and extreme public or 
government responses to the disclo- 
sure of AIDS or HIV infection may, and 
in some cases have, altered the very 
conditions of an individual’s member- 
ship in society: access to schools, 
work, medical care, even family and 
friends. That is the simple case to be 
made for the deepest possible respect 
for the privacy of the victims. 


On the other side, however, disclosure 
is required, though not nearly as often 
as is sometimes suggested. Scientific 
and medical communities may need to 
know who are the AIDS victims and 
HIV carriers in the quest to slow, stop 
or treat the disease. These competing 
concerns often call for conflicting 
courses of action. 


The report concludes that mandatory 
HIV antibody testing of such groups as 
public servants, inmates of federal pris- 
ons, immigrants and long-term visitors 
to Canada, would contravene the Pri- 
vacy Act. The Privacy Act prohibits the 
collection of personal information 
which is not related directly to a pro- 
gram or activity falling within the statu- 
tory mandate of a government institu- 
tion. Such testing is not a necessary 
element of any present legislated 
program. 


Of course, Parliament has the authority 
to override the Privacy Act and give 
government the power to subject 
groups of individuals to mandatory HIV 
antibody testing. However, any such 
action would represent an hysterical 
over-reaction to the AIDS epidemic — 
at least so it appears in the present 
state of knowledge about the disease. 


Any public health benefits that would 
be achieved through large-scale testing 
are dubious at best and would be far 
outweighed by the devastating invasion 
of privacy which would result. Fortu- 
nately, privacy interests accord with the 
most informed medical opinion that 
AIDS testing should always be volun- 
tary with pre-and post-test counselling. 


The Government of Canada has an 
important leadership role to play in 
ensuring that AIDS is sensitively 
handled in the workplace. The report 
urges Treasury Board, as Canada’s 
largest employer, to issue a compre- 
hensive policy on AIDS in the 
workplace. 


Confidentiality is an integral part of the 
workplace policy suggested by the 
World Health Organization. The 
employee should not be obliged to 
inform the employer about his or her 
HIV status, nor is there any need to 
inform co-workers. If AlDS-related per- 
sonal information is volunteered, it 
should be accorded a high degree of 
protection and, prior to employment, 
there should be no direct HIV screen- 
ing (testing) or indirect screening 
(assessment of risk behaviors or ques- 
tions about previous tests). 


One of the reasons most often given 
for individuals hesitating to undergo 
voluntary HIV antibody testing is the 
fear that they will not be able to control 
the extent to which third parties will be 
given access to the information. 
Indeed, the Privacy Act itself sets out 
some 13 circumstances in which 
government departments may disclose 
personal information to third parties 
without consent. In recognition of the 
particularly sensitive nature of AIDS 
information, AIDS and the Privacy Act 
recommends that a tightly controlled 
process be followed before any such 
disclosures are made. 


Most important, the decision of 
whether to disclose to third parties 
without consent should be made only 
by the head of the government institu- 
tion. The decision should be based on 
a consideration of: 


1. why disclosure is necessary, 

2. the potential adverse conse- 
quences of the disclosure on the 
individual(s) to whom it relates, 

3. the likelihood that the requestor 
can and will maintain the 
confidentiality of the information, 
and 

4. the likelihood that the requestor will 
use it only for the purpose for which 
it was Originally sought. 


The onus should always be on the 
requestor to justify the need to release 
the information without the consent of 
the individual(s) to whom it relates. 


These recommendations attempt to 
reflect an appropriate compromise 
between privacy concerns and the legi- 
timate needs of some government insti- 
tutions. Changes in the understanding 
of AIDS, its transmission, in public atti- 
tudes may compel re-examination of 
the recommendations as, of course, 
would a vaccine or cure. In the words 
of the report: 


“To hope for an early cure or an effec- 
tive vaccine is a natural human re- 
sponse to this terrible disease. But 
hoping does not diminish society's 
responsibilities today. The principles 
set forth here in responding to the pri- 
vacy issues in handling the personal 
information of those affected by HIV 
infection and AIDS may not give much 
long term comfort. But at least they 
make society’s response more humane. 
For the moment, perhaps, that is the 
best we can do.” 
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The Dawn of the Biotechnological Age 


By-and-large, the government collects 
information about individuals in tradi- 
tional ways, such as by surveys, forms, 
letters or direct observation. But even 
these old-fashioned methods can be 
abused, resulting in unacceptable inva- 
sions of privacy. More ominously, how- 
ever, intrusive collection techniques are 
gaining currency. 


Such methods (some newer than 
others) permit information about indi- 
viduals to be drawn directly from their 
biochemistry: i.e., the breathalyzer and 
polygraph. Urine tests, blood tests and 
genetic mapping are also becoming 
fashionable as means of finding out a 
person’s hidden (perhaps even from 
himself or herself) secrets. 


While these information collection tech- 
niques are best known in the law en- 
forcement environment, they are achiev- 
ing increasing popularity for screening 
purposes outside of the criminal justice 
sphere. Would you be a loyal and trust- 
worthy employee? Would you engage in 
behaviour likely to put others at risk? 
Have you broken the rules governing an 
activity in which you want to engage? 
Do you have a genetic predisposition to 
certain diseases or personality styles? 
Governments and private sector 
employers are being tempted to seek 
access to biochemistry to provide 
answers to these questions. 


The Department of National Defence, 
for example, tests the blood of its 
employees wishing to attend U.S. 
defence courses to determine if they are 
HIV free. The Canadian Security Intelli- 
gence Service gives prospective 
employees a polygraph test to deter- 
mine whether they are loyal and trust- 
worthy. Transport Canada is consider- 
ing whether transportation workers 
should have their urine tested for the 
presence of illegal drugs. 
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Sports Canada is urging that the urine of 
funded athletes be tested for the pres- 
ence of banned (not necessarily illegal) 
drugs which could enhance performance 
and undermine fair sporting competition. 
The RCMP is using genetic material for 
identification and a national “genetic fin- 
gerprint” inventory will be developed 
similar to that which now exists for 
fingerprints. Moreover, research is 
underway into techniques which would | 
enable detailed physical and behavioural 
profiles to be developed on individuals 
based on a DNA test. 


One commentator has argued that we 
are moving from the information age into 
the biotechnological age. In that transi- 
tion are privacy dangers the likes of 
which we have not seen in our history. 


If privacy is to have any meaning in the 
90s and beyond, great care must be 
taken to ensure that effective limits are 
placed on new, more intrusive means of 
information collection. Yet as we end the 
80s there are indicators that the policy- 
makers may not be so inclined. 


Some Officials testifying at the Dubin 
Inquiry strongly advocated mandatory, 
random and unannounced urine testing 
of federally-funded athletes. While a 
strong case can be made for such test- 
ing, it is troubling that a government 
policy, even in a well-defined area and 
with tacit consent of the athletes, appears 
to ignore a concept which is fundamental 
to individual privacy — the presumption 
of innocence. The need to prevent intru- 
sions into private lives, unless there is a 
specific and reasonable suspicion of 
wrongdoing, has been clearly articulated 
by the Supreme Court as part of 
Canada’s Charter of Rights and Free- 
doms. It has only been compromised in 
rare instances to protect life — instances 
such as random, roadside alcohol tests. 


Yet, in the case of athletes, the 
country’s offended national pride 
seems to be widely accepted as suffi- 
cient reason to ignore a fundamental 
principle of freedom. If we can justify 
the intrusions necessary to test ath- 
letes, and perhaps Mr. Justice Dubin 
will conclude that we can, will it not 
become easier for employers to justify 
intrusions into the bodies of their 
employees or potential employees? 
Canada’s inquiry into drug use by ath- 
letes may have an impact on our phi- 
losophy of individual privacy which will 
not end in the sports arena or at the 
locker room door. 


The principle reason why these annual 
reports have expressed concern about 
computer matching — the comparison 
of unrelated data bases to compile pro- 
files of certain individuals — is because 
it represents search and seizure of 
records without reasonable cause. For 
the same reason, the Privacy Commis- 
sioner will continue to monitor devel- 
opments in biotechnological screening 
programs in an effort to protect the pri- 
vacy of innocent individuals. 


Computer Security 


“security is concerned with 
protecting the computer from 
people; privacy with protecting peo- 
ple from computer” 


(Robert P. Bigelow) 
Computer Law and Security Report, 
March/April 1989 


Would it were as simple! In highly 
automated office environments, good 
computer security is essential to pro- 
tecting people from other people — 
perhaps the ultimate goal of privacy 
advocates. 


A totally secure computer system 
would appear to be an unattainable 
ideal in the current decentralized data 
processing world. Computer security 
professionals now talk of “trusted” 


rather than “secure” computer systems. 


(It’s a telling social comment that the 
term “trust” now implies a measure of 
distrust!) 


We are now in the young adulthood of 
the age of management information 
systems (MIS). Since the mid-70s the 
ability of the computer to perform 
multi-processing, to manipulate mas- 
sive files, to pass information over 
great distances in seconds and to allow 
many users to share the information 
resource has proven an integral part of 
the administration of government. 


It is no longer uncommon to enter a 
government office and find multi- 
purpose workstations connected to a 
mainframe computer system or to a 
network of computers wherein the data 
and, in some cases, the logic programs 
are purposefully or unwittingly shared. 


Over the past year the Office of the 
Privacy Commissioner delved into the 
labyrinth of computer security — a 
confusing world of specialized 
terminology and technology. Internal 
threats to computer systems come in 
strange forms: salamis, trap doors, 
logic bombs, Trojan Horses, and 
worms. External threats are equally 
exotic: viruses, spoofing, scanning, _ 
switcheroo, network weaving and pass 
through. 


And those who seek to counter these 
threats also “colour” the issue; in the 
U.S. the Department of Defence secu- 
rity standards are published in the 
“Orange Book” and explained in the 
“Yellow Book”. The security of net- 
working systems are dealt with in the 
“Raspberry Book” — and so it goes. 


The security challenges which the MIS 
environment poses are enormous and 
the Office of the Privacy Commissioner 
is in its infancy in developing the 
expertise to pinpoint problems and 
offer responsible, workable solutions. 
In the coming year, special emphasis 
will be placed on the security of EDP 
systems during our regular privacy 
audits of government institutions. 


Special tribute should be paid to the 
work of the System Security Centre of 
the Communications Security Estab- 
lishment. The Centre was established 
in August of 1988 to augment the com- 
puter security expertise of the RCMP 
and DND and to provide new capabili- 
ties for the evaluation of computer and 
network security products for the 
Government of Canada. Part of the 
impetus driving Canada to develop its 
own trusted computer security evalua- 
tion criteria was the Privacy Act. There 
was a recognition that, although the 
protection of national security informa- 
tion poses the most difficult technical 
problems, the most widespread pro- 
blem was the need to protect the pri- 
vacy of personal information held by 
government. 


The Privacy Commissioner welcomes 
this initiative and looks forward to a 
continuing exchange of information 
and ideas with the Systems Security 
Centre. 
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CSIS Files 


Another collection of highly-sensitive 
personal information continued to be a 
matter of concern over the past year — 
the intelligence files inherited by the 
Canadian Security Intelligence Service 
(CSIS) from the former Security Ser- 
vice of the RCMP. Much of the informa- 
tion contained in these files does not, 
at least in the view of the Security Intel- 
ligence Review Committee, meet the 
tests for collection under the CS/S Act 
now that the definition of “threats to 
the security of Canada” has been more 
precisely drawn. 


Thus, CSIS finds itself in the awkward 
position of being the custodian of 
information about individuals which it 
would not be entitled to collect under 
the terms of its present mandate. 


The solution seems simple — dispose 
of the old files! 


In fact, CSIS has set up a unit to review 
the files, extract what is of continuing 
legitimate significance to CSiS and 
dispose of the rest. But, the process is 
laboriously slow; — some of these files 
have been “sequestered”, others have 
become subject to special rules 
governing internal access to and use of 
the files. Consultations are in progress 
between CSIS and the National Ar- 
chives to determine what information 
should be archived and under what 
conditions. 
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Yet, the shredders do get used! Since 
the lifting of the file destruction morato- 
rium imposed in 1985 (after concerns 
were expressed by the Deschénes 
Commission on war criminals), some 
120,000 security service files have been 
disposed of. This includes 67,000 which 
had previously been scheduled for de- 
struction by the RCMP, and 53,000 re- 
viewed prior to disposal by CSIS. It is | 
comforting that the review has resulted 
in CSIS keeping fewer than 100 files. 
There remain, however, many thou- 
sands of files whose appointment with 
the shredder is years away. 


These old RCMP files create a further 
complication for CSIS. As authorized 
under the Privacy Act, CSIS will neither 
confirm nor deny the existence of 
information which is of continuing intel- 
ligence value. Such information is 
contained in bank SIS/P-PU-010. 
Neither will it confirm nor deny the fact 
that no information exists when a Pri- 
vacy Act request is made to that bank. 
Both the Privacy Commissioner and the 
Federal Court of Canada have accepted 
that the so-called “mosaic effect” 
requires CSIS to take this approach. 


However, CSIS will confirm the exis- 
tence of certain personal information 
which was gathered by the former 
RCMP Security Service. Dated, less 
sensitive information of this type is 
maintained in bank SIS/P-PU-015. Its 
existence will be confirmed and the 
information will be released to a reques- 
tor subject to any of the specific exemp- 
tions which are set out in the Privacy 
Act. It has not proved possible to reach 
agreement with CSIS on a set of guide- 
lines which would define what consti- 
tutes “less sensitive” information, this 
despite a genuinely good faith effort on 
the part of CSIS to respond to the 
concerns raised by the Privacy Com- 
missioner in his last annual report. 


————————————————— ———— 


As requests are received, CSIS decides 
where to allocate (bank 010 or 015) the 
former RCMP Security Service intelli- 
gence information. This appears to be 
the only practical approach until all 
records are disposed of which do not 
meet the CS/S Act’s collection 
requirements. 


The Privacy Commissioner is pleased 
to report that CSIS plans to accelerate 
its review and disposal of files. In the 
next two years it intends to review for 
disposal twice as many as during the 
past five years. The Privacy Commis- 
sioner applauds the initiative but 
considers the process should be inde- 
pendently monitored to ensure that all 
information which does not meet the 
“strictly necessary” requirement of sec- 
tion 12 of the CS/S Act, is actually dis- 
posed of and not merely recycled into 
other formats. 


The Inspector General (under sections 
30 and 31 of the CS/S Act), the Security 
Intelligence Review Committee (under 
section 40 of the CS/S Act) and the 
Privacy Commissioner (under section 
37 of the Privacy Act) all appear to 
have the power and mandate to provide 
such independent inspection. 


The Privacy Commissioner will, in the 
coming months, consult with the rele- 
vant parties to determine how this file 
disposal monitoring can be carried out 
without unnecessary duplication of 
effort. 
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What’s with the Cheque? 


Mailing lists are a private sector privacy 
issue which everyone understands. But 
few in the private or public sector have 
mailing lists as up-to-date and com- 
plete as the federal government. 


Consider just three. 


e the government’s own employees 
(including the armed forces and the 
RCMP) 350,000; 


e family allowance/old age pension/ 
Canada Pension Plan recipients’ list, 
(approximately 5.5 million names and 
addresses); 


e and the income tax list (about 17 
million). 


These three lists would be a veritable 
gold mine for direct mailing. Some 
brazen requests for them have already 
been made. 


Item: A publishing house asked Health 
and Welfare for the list of all Canada 
Pension Plan recipients and applicants. 
The reason? To send an advertising 
brochure offering legal services to 
anyone with a pension problem. 


The federal government is prohibited 
from selling (or giving away) its mailing 
lists. But what about the government's 
own use Of its lists. Government 
departments and agencies have recog- 
nized government cheque envelopes as 
a cost-efficient method of communicat- 
ing with their clients. The cost of 
enclosures with regular government 
mailings pales beneath that of an 
advertising campaign and targets more 
successfully. It would even be an excel- 
lent way of advertising the blessings of 
the Privacy Act! (“Do you know your 
privacy rights?”) 
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Family allowances and pension re- 
cipients are accustomed to finding 
information notices with their monthly 
cheques. Privacy violations or not? 


No violation providing the information 
relates directly to the mandate of the 
department on whose behalf the 
cheque is issued. Thus, Health and 
Welfare Canada can appropriately 
inform pensioners of changes in bene- 
fits or remind parents to keep their 
children’s innoculations up-to-date. 


But there is potential for abuse. To its 
credit, this has not escaped the atten- 
tion of the Treasury Board. As a result, 
the board now requires departments to 
obtain its permission to enclose 
material with a regular government 
mailing. The record is generally good. 
However, in spite of the closer monitor- 
ing, some five of the 50 mailings last 
year were unrelated to the original pur- 
pose of the mailing list. 


Examples: Information on the Canada- 
U.S. Free Trade Agreement was offered 
in one enclosure which was sent to all 
nine million recipients of Family 
allowance, Old Age Security and 
Canada Pension Plan. Pension and 
salary cheques to past and present 
public servants were accompanied by 
appeals to purchase Canada Savings 
Bonds and to contribute to United Way 
Campaigns. 


Clearly, there are conflicting goods 
here. The government's own communi- 
cation policy sensibly obliges depart- 
ments and agencies to tell the public 
about their activities. Canada Savings 
Bonds are essential to the govern- 
ment’s financing and individuals want- 
ing to buy undoubtedly value knowing 
about the bonds and the procedures 
for automatic deductions. As well, the 
United Way depends heavily upon 
public servant’s contributions, which 
are greatly facilitated by payroll 
deductions. 


Yet, the principle in the Privacy Act is 
clear. Information collected for one 
purpose cannot be used for another 
purpose. 


There will be some difficult applica- 
tions of the law, some hard judgment 
calls. The Privacy Commissioner seeks 
not to be the Grinch who stole the 
Christmases which United Way agen- 
cies provide. But the Privacy Commis- 
sioner very much wants to stop 
government mailings being used for 
distributing political statements. 
Government junk mail is still junk mail. 


What accompanies a government 
cheque bears some close watching. 


Consultations are underway with 
Treasury Board to set guidelines to 
ensure government mass mailings 
conform with the Privacy Act. 


Complaints Directorate 


This year’s startling 20 per cent 
increase in new complaints (1,050 
compared to 691 in 1987/88) is difficult 
to explain. It may simply reflect a 
return to the pattern of a 10 per cent 
annual increase evident since the pro- 
gram began, making last year’s drop an 
aberration for which this year’s case- 
load compensated with a vengeance. 
This can be said: there is no reason to 
attribute the increase to growing resis- 
tance to either the letter or spirit of the 
Privacy Act. 


The return to the larger numbers was 
accompanied by more complaints 
about the length of time departments 
took to respond to requests. This is 
disappointing. The Commissioner had 
hoped that the delay problem would 
resolve itself as departments gained 
experience. In fact, the office investi- 
gated 414 delay complaints, 243 of 
which were against the Correctional 
Service of Canada (CSC) — the result 
of a marked increase in applications. 


Despite the substantial rise in new 
complaints, the Commissioner and his 
staff whittled away the 296 cases 
carried over from last year. Only four of 
these now remain. 


Overall, investigators completed 1,028 
cases during the year, an increase of 
56 per cent over the preceding year. 
The directorate continues to reduce the 
time required to complete an investiga- 
tion. The new performance standard 
for an investigation is three months (on 
average), with no complaints outstand- 
ing for longer than six months. At the 
end of the reporting year, 94 per cent 
of the complaints were less than six 
months old. 


The acceleration can be partially 
explained by the addition of three staff 
positions to the directorate, given in 
anticipation of Crown corporations 
being made subject to the Privacy Act. 
By the end of the year these corpora- 
tions were still not covered so the addi- 
tional investigators allowed the office 
to keep pace with the large increase in 
complaints. With the directorate now | 
fully staffed, the office is confident of 
continuing to meet the new per- 
formance standard — at least until the 
Crown corporations come on stream. 


Statistics — “a rose by any other 
name” 


The terminology in this report describ- 
ing the disposition of complaints is a 
little different from previous years. The 
change makes consistent the terminol- 
ogy used by the departments in report- 
ing their statistics to the Treasury 
Board and that of the Privacy Commis- 
sioner’s office. Discussions with the 
board and all other parties resulted in 
the following: 


Not well-founded 
(formerly “dismissed”) 


Well-founded, resolved (formerly 
“justified”). This means that negotia- 
tions led to what the Commissioner 
considered a reasonable resolution of 
the problem. It does not always mean 
that the complainant was completely 
satisfied. 
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Well-founded. This signifies that there 
was some breach of the Privacy Act 
which was not resolved, either because 
material could not be found, had 
already been destroyed, or time limits 
had been exceeded. This term is also 
used when access has been denied and 
the Commissioner has threatened to 
take court action in order to have the 
information released. 


Abandoned. This indicates that the 
complainant has withdrawn the com- 
plaint (often because the problem has 
been solved before the investigation 
begins), or has not responded to 
follow-up calls or letters. 


Origin of Completed 
Complaints by Province and 


Territory 

Newfoundland 3 
Prince Edward Island 35 
Nova Scotia Ve 
New Brunswick 165 
Quebec 240 
National Capital Region 

Quebec 4 
National Capital Region 

Ontario 53 
Ontario 200 
Manitoba 21 
Saskatchewan 96 
Alberta 57 
British Columbia 134 
Northwest Territories 1 
Yukon 0 
Outside Canada 2 
TOTALAMosMd oan ORs 
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Cases 


CEIC can seek UI medical claim 
details 


An Ontario man objected to the 
amount of medical information the 
Canada Employment and Immigration 
Commission (CEIC) collected when he 
claimed unemployment insurance 
medical benefits. 


The man was on modified duties at the 
time of his layoff because of an injury. 
He gave CEIC information from his 
doctor that stated the recuperation 
period and his claim was accepted. A 
week later, a specialist extended the 
recuperation period because the injury 
was not healing well. Later, the period 
was extended again. Each time he 
informed CEIC. 


Following the second extension, CEIC 
asked for and received a completed 
form from the doctor. However, the 
commission found the information to 
be insufficient and asked for more 
detail. The doctor completed the form 
reluctantly because he considered the 
details privileged information. 


During investigation it became ap- 
parent that the two doctors had sup- 
plied conflicting information. When this 
happens, CEIC requires, and is autho- 
rized to get, a diagnosis to settle the 
claim. The Commissioner concluded 
that CEIC officials were exercising 
prudent judgment as set out by the 
Unemployment Insurance regulations, 
by corroborating the information. He 
considered the complaint not well- 
founded. 
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Marriage data needed for passport 


An Ottawa man complained that he 
had had to reveal his past and current 
marital status to the individual who 
guaranteed his passport application. 
He also worried that External Affairs 
collected too much information in his 
application. 


Passport applications ask “if you are or 
have been married”. The form explains 
that the details are needed for “identity, 
citizenship and/or custody of children.” 
However, investigation revealed that 
the information is required in only 
three instances when: 


“the surname on the passport was 
assumed after marriage (either the 
spouse’s Surname or a combination of 
birth surname and spouse’s Surname); 


*when children are to be included on 
the passport (the details help deter- 
mine legal custody); 


*a female applicant was married toa 
non-British subject prior to January 1, 
1947. She may have ceased to be a 
British subject because of the marriage 
and, according to the laws at that time, 
not a Canadian citizen. 


In all other cases, passport examiners 
may waive the marriage data 
requirement. 


The Commissioner agreed that Exter- 
nal Affairs needed the information but 
questioned whether the application 
form made it clear that it was limited to 
the three circumstances. External 
Affairs agreed to explain this on a new 
form. 
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The Commissioner rejected the posi- 
tion that requiring the guarantor to 
Know marriage details was an invasion 
of privacy. A guarantor is not simply a 
witness to the applicant’s signature, but 
attests, to the best of his or her knowl- 
edge, that the information is correct. 


“Since a Canadian passport allows the 
bearer to enter Canada ...as a matter 
of right, | believe that disclosure of the 
information to the person attesting... 
Cannot be viewed as an unreasonable 
requirement”, the Commissioner said. 


He considered the complaint not 
well-founded. 


RCMP may release subpoenaed 
information 


A lawyer involved in a lawsuit with an 
insurance company complained that 
the RCMP had, without consent, given 

‘the company’s lawyer a copy of his 
client’s statement to police. 


The RCMP explained that it had dis- 
cussed that portion of the file with the 
company’s lawyer but had neither pro- 
vided a copy nor allowed her to see 
one. However, all the information had 
been subpoenaed at an earlier criminal 
trial of another man. The RCMP pro- 
duced the information in response to 
the subpoena and it was now part of 
court records. Thus, the RCMP discus- 
sed nothing which had not already 
been disclosed at the trial. 


The complaint was dismissed because 
the Privacy Act allows government ins- 
titutions to release personal information 
in response to a subpoena. 


No charge to use Privacy Act 


A senior citizen complained when 
charged $25 to use the Privacy Act. He 
had seen information about using the 
Act in the Seniors Guide to Federal 
Programs and Services, a Health and 
Welfare Canada publication. He applied 
to National Archives for his employ- 
ment file and to Canada Employment 
and Immigration Commission (CEIC) 
for his immigration file. 


National Archives redirected his appli- 
cation to his former employer and 
shortly thereafter he received the 
information. However, CEIC charged 
him $25 for his immigration docu- 
ments. Because the guide had not 
mentioned a charge, he wrote to Health 
and Welfare suggesting it include such 
information. 


An investigator found that CEIC staff 
had misunderstood the man’s request. 
Seniors often need certified copies of 
landing documents to support pension 
applications, a service for which CEIC 
charges. Once CEIC realized the 
request was not for certified copies but 
simply to see the file under the Privacy 
Act, it refunded the $25. 


The complaint was well-founded/ 
resolved. 


Keep performance appraisals five 
years 


A complaint that a department was 
keeping employees’ performance 
appraisals too long ended up involving 
Revenue Canada/Customs and Excise, 
National Archives, the Treasury Board 
and the Privacy Commissioner. 
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The complainant told the Commis- 
sioner that Customs and Excise was 
retaining annual appraisals longer than 
the three years described in the Per- 
sonal Information Index. The length of 
time that appraisals are held (the reten- 
tion schedule) is established by Na- 
tional Archives in consultation with the 
Treasury Board. Customs and Excise 
considered the schedules as policy, not 
law, and not subject to complaint. 
Treasury Board, however, considers 
the schedules to be the law. 


The Commissioner agreed to study the 
matter. The investigator confirmed that 
Customs and Excise was keeping the 
man’s appraisal (and all appraisals) 
beyond three years. Through consulta- 
tions involving the department, Trea- 
sury Board and National Archives, he 
discovered that Treasury Board had 
changed the retention period to five 
years but the department had not been 
made aware. 


After discussion, Customs and Excise 
concluded that the intent of Treasury 
Board’s policy was clear and agreed to 
comply with the five year period. 


Test scores need expert 
interpretation 


A lawyer preparing an appeal sought 
information about her client from two 
Correctional Service of Canada (CSC) 
banks. She complained when CSC 
withheld information. 


Investigation revealed that much 
material in the Offender Health Care 
Record bank was supplied in confi- 
dence by a province, and thus CSC 
was obligated not to release it under 
the Privacy Act. The investigator sug- 
gested that the lawyer apply using the 
provincial privacy legislation. 


CSC had also exempted raw psycho- 
logical test data from a Psychology 
bank, maintaining that releasing medi- 
cal information would not be in the 
inmate’s best interests. CSC argued 
that releasing test results in raw form 
would make it subject to misinterpreta- 
tion by laymen. 


According to a CSC psycnologist, the, 
test is copyright and psychologists are 
not free to provide copies. He also 
argued that revealing test questions, 
individual responses and scores would 
render the test invalid — particularly in 
a closed population like a prison. Fur- 
ther, test results can vary daily accord- 
ing to the subject’s health or mood. 
Again, a layman might misinterpret 
such variations and one-time scores. 


The doctor suggested that the lawyer 
hire a registered psychologist as an 
expert witness to whom the doctor 
could release the documents. 


The Commissioner found compelling 

the doctor’s arguments against releas- 
ing this type of information in a prison 
environment and considered the com- 
plaint not well-founded. ; 


Applicant gets reference comments 
only 


Several potential and former RCMP 
members applied for information from 
their security clearance records and 
complained when the Force withheld 
the names of persons interviewed 
during the security clearance process 
and their comments. 


The RCMP argued that it must take 
extraordinary care in screening police 
officers. For example, police officers 
have the power to arrest and carry 
firearms. Temperament and moral char- 
acter are therefore of special impor- 
tance. The RCMP argued that it must 
protect its sources to ensure candor. 


After discussing the complaints with the 
investigator, the RCMP staff agreed to 
review the material. It concluded that 
the sources’ comments could be re- 
leased, but it withheld their names (or 
other identifying details) to protect the 
integrity of the inquiry. 


The Commissioner agreed with the 
resolution and considered the com- 
plaints well-founded but resolved. 


World War II hospital records gone 


Despite a thorough effort by National 
Archives, a British Columbia man did 
not receive all the information he 
wanted from the Archives’ Medical 
Records World War II bank. 


He told the Commissioner that the 
material Archives sent excluded docu- 
ments from his stay in a particular hos- 
pital in the 1940s. This included a form 
he had been required to sign stating that 
he would not apply for a military 
pension. 


At the request of an investigator, 
Archives searched other banks but with 
no success. Archives found the records 
of the hospital (which no longer exists), 
but lacked those of the period covering 
the complainant’s treatment. 


The investigators then asked the 
Department of Veterans Affairs who also 
searched, without success, for the miss- 
ing files. 


The Commissioner concluded that the 
files cannot be found and that Archives 
had responded to the best of its ability. 
The complaint was not well-founded. 


Informant’s name withheld in tax 
case 


A woman complained to the Manitoba 
Institute of Chartered Accountants that 
her former chartered accountant had 
acted unprofessionally. The institute 
began an investigation and applied to 
Revenue Canada, Taxation on the 
woman's behalf for her individual 
income tax return file. 


Revenue Canada withheld some infor- 
mation because it either concerned 
another person or its release could “be 
injurious to the enforcement of the 
Income Tax Act”. 


The lawyer complained to the 
Commissioner. 


The investigation confirmed that some 
of the information was about someone 
else and was thus properly exempt. The 
rest concerned a confidential source. 
The Commissioner agreed that release 
of the material could threaten enforce- 
ment of the Income Tax Act. However, 
he added that a strong argument could 
be made that the public good would be 
best served by releasing the information. 
Nevertheless, the Privacy Act gives the 
department discretion to decide and he 
did not believe that Revenue Canada 
had exercised the discretion improperly. 


The complaint was not well-founded. 


Grounds of Complaints and Investigation Results 


Well- Well- Not Well- 
Grounds Aband. founded found.Res. founded Total 
Access 16 8 69 410 503 
Use & Disclosure 6 8 7 29 50 
Correction/Notation 0 1 6 10 uy 
Time Limits 4 oir. 14 79 414 
Language 0 1 0 23 24 
Index 0 0 0 0 0 
Collection 2 1 2 12 1%, 
Retention/Disposal 0 0 0 o 3 
TOTAL 28 336 98 566 1028 


Employer compares sick leave 
records 


A woman asked the Commissioner's 
Office whether Canada Post, which 
employed both her and her husband, 
could use her attendance records to 
investigate her husband’s attendance 
problems. Her file had been given to a 
supervisor to whom she does not 
report and her husband found one of 
her attendance cards in his own file. 


The investigation had to determine 
whether it was proper to match the 
couple’s attendance records to verify 
her husband's attendance. 


Canada Post considered the use 
consistent with the purpose for its 
collection—to ensure that employees 
respect their leave entitlements in the 
collective agreement. Canada Post held 
that when management suspects 
abuse, it was “natural” to review atten- 
dance records “including those of two 
or more individuals where warranted”. 


The Commissioner advised Canada 
Post that, while he understood the 
motivation, the practice appeared to 
contravene the Privacy Act. He invited 
Canada Post to respond before he 
made a final decision. 


Canada Post replied that matching 
“supported the attendance and leave 
function” when management suspects 
employees are colluding to abuse 
leave. Canada Post maintained that the 
only option to matching records to 
confirm fraudulent leave claims would 
be an even more intrusive investigation. 


The Commissioner was unconvinced. 
He had difficulty accepting that un- 
regulated comparisons between the 
attendance records of spouses, other 
family members and golfing buddies 
were integral to attendance manage- 
ment. He concluded that accepting the 
position was tantamount to discrimina- 
tion against employees whose relatives 
or friends also worked for the post 
office. He recommended that Canada 
Post stop the comparisons. 
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Canada Post did not agree but was 
prepared to discuss a resolution. After 
further negotiations, Canada Post 
adopted guidelines to control the prac- 
tice. Under the new guidelines, indi- 
viduals’ attendance records will con- 
tinue to be reviewed but will only be 
matched with those of others to gener- 
ate depersonalized information or, if 
necessary, to confirm or disprove a pat- 
tern of common absenteeism already 
observed among employees. 


The guidelines also restrict who may 
see and compare the information and 
to whom it may be disclosed. 


Can’t use tax files for discipline 


A tax auditor, fired for falsifying her 
income tax returns, complained to the 
Privacy Commissioner that Revenue 
Canada, Taxation had breached both 
the Income Tax Act and the Privacy Act 
when it used her tax returns for disci- 
plinary purposes. 


A week prior to filing the complaint, the 
woman had asked the Federal Court to 
declare that Revenue Canada could not 
use the tax return information, except 
as allowed by the /ncome Tax Act. In 
particular, she argued that her tax 
returns should not be used as evidence 
in a hearing about her discharge. 


The Commissioner postponed his find- 
ing until the court ruled. The judge 
agreed that when Revenue Canada is 
acting as an employer, it is not entitled 
to use individual tax returns for per- 
sonnel purposes. 


The Privacy Act allows the department 
to use personal information only for the 
purpose for which it was collected, 
“subject to any other act of Parlia- 
ment”. Since the use was not one for 
which it was gathered, nor was it a cor- 
rect use under the Income Tax Act 
according to the court, the Commis- 
sioner concluded that the complaint 
was well-founded. 


This does not mean that Revenue 
Canada may not discipline employees 
who evade taxes. It does mean that the 
department should treat the employee 
as it would anyone else it suspects of 
tax evasion, then take appropriate dis- 
ciplinary action if he or she is found 


guilty. 
Ham radio operators’ data released 


An amateur radio operator complained 
because the Department of Communi- 
cations (DOC) releases amateur 
broadcasters personal information to 
amateur radio societies and publishers 
to print directories (call books) of 
licensed operators. DOC maintains a 
database of the licensees which 
includes names and addresses. 


The operator opposed release of his 
personal data because he did not want 
to become the target for “junk” mail or 
thieves seeking expensive radio 
equipment. 


The complaint influenced DOC to put 
on hold release of the information 
pending the Privacy Commissioner's 
decision. This prompted a barrage of 
calls and letters from operators to both 
DOC and the Commissioner’s office. 
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The investigation found that DOC 
release of the information is a compli- 
cated issue. DOC officials told the 
Commissioner why the department 
considers the release “consistent with” 
the purpose for its collection. 


DOC explained that it is responsible for 
managing the radio spectrum, a limited 
public resource. Individuals who pass 
the examinations are assigned a call 
signal and are licensed to use a portion 
of the public air waves. Publicly identi- 
fying these operators allows them to 
police themselves since misuse by 
amateurs can interfere with other radio 
transmission. As radio saturation and 
electro-magnetic interference grows, 
DOC considers this policing an impor- 
tant part of spectrum management. 
DOC also argued that it was not sound 
public policy to allow individuals to 
enjoy a shared resource with 
anonymity. 


As a member of the International Tele- 
communication Union, DOC is obli- 
gated to provide public access to 
names, addresses and call signs under 
two articles of international regulations 
which deal with investigating inter- 
ference, communication amongst oper- 
ators and their self-training. 


As well, DOC discloses licensing 
information to permit communication 
amongst amateurs, including verifying 
signals and technical details. This 
helps operators who are required by 
the radio regulations to confirm that a 
contact is a licensed amateur. DOC is 
also required to release the names and 
licence status of amateurs using shared 
systems (such as satellites) which are 
funded and maintained by the amateur 
community. 


DOC agreed that not all operators want 
to join clubs, volunteer for emergency 
communications services or be listed in 
call books. However, it considered that 
amateurs may not opt out of their re- 
sponsibility to make public their use of 
the airwaves. 


The Commissioner accepted DOC’s 
strong case for disclosure and noted © 
that operators may ask private call 
book publishers not to list their infor- 
mation. He considered the complaint 
not well-founded. 


Solicitor-client privilege widely 
drawn 


A woman involved in a wrongful dis- 
missal suit against Transport Canada 
applied for her information in its 20 
standard employee banks. Her com- 
plaint alleged slow response and the 
withholding of material. 


The investigation found that there was 
no information about the woman in 14 
of the banks. It was also evident that 
information had been withheld from 
the grievance file, some because it 
concerned another person and some 
because the department considered 
that it was protected by solicitor-client 
privilege. 


The investigator found that Transport 
Canada had exempted the request for 
its lawyer’s opinion, the opinion itself, 
and all the background material. This 
material — part of the regular griev- 
ance file — was withheld in order to 
seek a legal opinion. The department 
held that once this information was 
attached to the request for legal advice, 
it became privileged. 
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However, legal precedents are clear that 
solicitor-client privilege covers commu- 
nications between the parties and 
materials created or obtained specifi- 
cally for litigation. All documents given 
by a client to a legal adviser are not priv- 
ileged. For example, when facts are 
obtained from other sources, not for or 
by legal counsel, they are not privileged. 


The Commissioner advised Transport 
Canada that he considered its view 
“extends unacceptably the concept of 
privilege”. His recommendation to 
release the grievance file material 
prompted the department into partial 
release of the information. The Com- 
missioner proposed to the complainant 
that he take her case to the Federal 
Court. She agreed and the Commis- 
sioner notified the department. In the 
meantime, Transport Canada had re- 
ceived advice from the Department of 
Justice and decided to release the 
material. The Commissioner considers 
the complaint well-founded. 


Completed Complaints by Department, Type and Result 


Well- Not 
Well- founded Well- Dis- 
Department Total founded | - Resolved | founded | continued 


: Canada Labour Relations 
Board 


Canada Ports Corporation 


Canadian Human Rights 
Commission 


Communications, 
Department of 


Correctional Service 
Canada 


Energy, Mines and 
Resources Canada 


Indian and Northern 
Affairs Canada 


Justice Canada _ 


Labour Canada 
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Well- 
Well- founded 
Department Total founded | - Resolved 


Getenel DaTEnee 
National Parole Bc ao 
Office of the 


Chief Electoral 
Officer 


Official Languages. 
Office of the 


Correctional 
Investigator 


Revenue Canada - 
Taxation 


Royal Canadian © 
Mounted Police 


Security Intelligence 
Review Committee 


Solicitor General 
Canada 


Transport Canada 


Veterans Affairs Canada 


Not 
Well- 
founded 


Dis- 
continued 
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Caseload by grounds 1988-89 


Access (48.93%) Delay (40.27%) 


Misuse (4.86%) 
Language (2.33%) 
Collection etc. (1.95%) 
Correction (1.65%) 
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Completed complaints and grounds 1983-89 


+83-84 84-85 85-86 *86-87 88-89 


ACCESS [] DELAY Ci<OTHER 


+ 9 Months * Revised counting method 


366 363 


+83-84 84-85 85-86 *86-87 87-88 88-89 
M@ RECEIVED E] COMPLETED [] UNDER INVESTIGATION 


+9 Months “Revised counting method 


Inquiries 


Inquiries to the Privacy Commissioner's 
office almost doubled in this fiscal year 
as the staff dealt with 2,041 compared to 
1,248 in the previous year. The office 
now has a full-time inquiries officer who 
handles the majority of the calls. Her 
improved system of logging all inquiries 
makes the increase appear greater than 
it actually is. Before this, many calls 
were simply not included as staff mem- 
bers fielded them but lacked the time to 
officially record them. 


Queries cover a broad range. They can 
be as simple as forwarding an applica- 
tion to see personal information to the 
proper department (approximately eight 
per cent of inquiries). 


They can also be as time-consuming 
(but ultimately satisfying) as following 
up an MP’s call about a detailed ques- 
tionnaire which temporary helpers at 
Canada Post had to complete before 
they were hired to deliver advertising 
mail. Canada Post, after discussion with 
this office, stopped using the question- 
naire. Calls about using and interpreting 
the Privacy Act make up 46 per cent of 
the inquiries. 


Questions and complaints about the use 
of social insurance numbers climbed to 
21 per cent of all inquiries during the 
year, due in large part to an amendment 
to the Income Tax Act which requires 
everyone to give their SIN to their finan- 
cial institutions. Some callers were 
incensed at the apparent contradiction 
between the government's newly- 
announced policy on restricting the 
number and a requirement to put the 
SIN in the hands of their bank, trust 
company, credit union, caisse populaire 
and stockbroker. Callers were also 
being told they had to give it to real 
estate agents (who were banking 
deposit cheques) and to insurance 
agents. 


Other callers were disturbed at what 
they considered the “secrecy” with 
which the new requirement was intro- 
duced. In fact, as noted earlier, the 
amendments to the Income Tax Act 
went through normal Parliamentary 
procedures. MPs did not query the new 
SIN requirements and the media did not 
report them. Most callers discovered the 
new law, which imposes a fine for failure 
to produce the SIN, when they bought 
the new series of Canada Savings 
Bonds or went to the bank. They were 
not amused. 


About ten per cent of callers are 
concerned about federal agencies that 
are not subject to the Privacy Act, often 
Crown corporations such as Air Canada 
and Canadian National Railways. Some 
Crown corporations are expected to be 
covered by the Act in 1989. 


Fifteen per cent of the calls concerned 
privacy issues in either the provincial or 
private sector and thus were beyond the 
authority of this office. For example, an 
Ontario woman called to determine 
whether the Privacy Act would prevent 
her municipality from selling its voters 
list to companies or individuals. The 
office was unable to investigate since 
municipalities are not covered by the 
Privacy Act and will not be subject to 
the Ontario legislation until 1991. (Fed- 
eral enumeration lists, by comparison, 
may not be sold.) 
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Compliance Directorate 


Who Was Audited 


The Commissioner's office again selec- 
ted audit candidates nominating tar- 
gets according to overall level of risk 
measured as objectively as possible. 


Selected were Canada Post Corpora- 
tion, the Secretariat of the Ministry of 
the Solicitor General and Employment 
and Immigration Canada. In addition to 
these major institutions, audits were 
done on several smaller institutions: 
the Department of Finance, the Pen- 
sion Appeals Board, and the Science 
Council of Canada. 


Small agency audits are being con- 
cluded in the Law Reform Commission, 
International Development Research 
Centre, the Canadian Cultural Property 
Export Review Board, Export Develop- 
ment Corporation and Canadian 
Patents and Development Limited. 


How and What was Audited 


Audits are conducted by teams of two 
to four investigators who visit selected 
headquarters units and a number of 
regional offices. Investigators review a 
random sample of files from selected 
information banks and interview mana- 
gers and staff who use and control the 
files. 


The auditors examine: 


* the institution’s collection, use, dis- 
closure, retention, disposal and secu- 
rity of personal information; 


*the adequacy of internal policies and 
compliance with central agency policy 
and guidelines on personal 
information; 


* the accuracy and completeness of lis- 
tings in the Personal Information Index; 


* staff awareness of the Privacy Act 
and its implications for handling per- 
sonal information; 


* individuals’ access to their personal 
information; 


* delegation of powers by the depart- 
ment head. 


Once the audit is completed, the audi- 
tors discuss it with the managers, 
focussing on any areas of non- 
compliance. The department first 
receives Summaries of findings, then an 
audit report. In line with accepted audit 
practice, the reports address only those 
areas requiring correction. 


Auditing the Auditors 


Six auditors cannot in a short time 
cover all government agencies under 
the Privacy Act’s authority. Thus, the 
Privacy Commissioner has always 
urged departments’ internal auditors to 
audit for privacy. The year provided 
encouraging evidence of this 
happening. 


The Canada Employment and Immigra- 
tion Commission responded. After 
consulting the Commissioner's office, 
its internal audit bureau began a review 
of CEIC’s personal information 
handling. Privacy staff then examined 
the auditors’ working papers to deter- 
mine the level of reliance they could 
place on the audit. That review dis- 
closed a thoroughly professional audit 
which the Privacy Commissioner could 
accept with as much confidence as if it 
had been done by his own auditors. 
(The findings are summarized else- 
where in this section.) 
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What Was Found 


Some findings apply to all of the agen- 
cies audited. For example, few 
employees outside of the access to 
information and privacy units know 
about their rights under the Privacy Act 
or understand their responsibilities for 
the proper collection, retention, use, 
disclosure and disposal of personal 
information. 


Inadequate protection of personal 
information is another common find- 
ing. Operational (and even some secu- 
rity) staff do not yet fully understand 
the new government security policy, 
particularly those sections which deal 
with the protection of personal infor- 
mation. Nevertheless, auditors found 
no indications that personal informa- 
tion had been compromised. 


Auditors again found personal informa- 
tion holdings that had not been identi- 
fied or properly described in the Per- 
sonal Information Index. Similarly, 
some uses of personal information 
which the institution considered 
“consistent” with the purpose for the 
Original collection, were not included in 
the Index descriptions. 


The audits underscored the need for a 
government-wide policy covering who 
may see personnel files. Such policy 
should consider the subtleties of the 
Privacy Act and limit the amount of 
personnel information managers need 
for discharging the legitimate demands 
of their positions. The current organi- 
zation of most personnel files pre- 
cludes segregating the information 
according to the “need to know” 
principle. 
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Security and Privacy 


Most staff treat information security as 
the domain of security officers or 
management information specialists. 
Both of these groups are trained to 
think of security in terms of classifica- 
tion in the “national interest’, not indi- 
vidual privacy. They are often not pre- 
pared to deal with the designation 
“protected”, which now applies to all. 
information which is personal but not 
in the national interest. 


Treasury Board, the Communications 
Security Establishment, the RCMP and 
the Privacy Commissioner’s staff have 
taken major steps toward creating staff 
awareness about the protection of per- 
sonal information. Until now, this 
information has often not been con- 
sidered as security sensitive. 


Continuing consultation among these 
organizations has produced levels of 
protection that match the sensitivity of 
the personal information. These levels 
will be included in the government’s 
security policy statement. The publica- 
tion and application of this new policy 
should help departments realize secu- 
rity standards for all designated 
information. 


Incident investigations 


The office investigated one lost docu- 
ment incident during the year and main- 
tained a watching brief over another 
department's investigation of missing 
records. The investigation concerned 
the loss of tax microfiche from the 
Calgary district office of Revenue 
Canada, Taxation. Revenue Canada told 
the Privacy Commissioner in October 
1988 that it had lost 38 sheets out of a 
set of microfiche. The sheets identified 
employers (by code number only) and 
their employees by surname, initials, 
social insurance number, earnings, pen- 
sion, unemployment insurance 
contributions and other deductions. 
Each fiche (or sheet) could contain data 
on more than 8,000 individuals. 


The investigation began at the Ottawa 
Head Office. Investigators followed the 
procedure for producing and shipping 
microfiche sets and were convinced that 
the set would have arrived intact at its 
destination. 


Investigators followed the fiche’s trail at 
the Calgary District Office. Once the 
fiche had been opened and counted, 
they were put in a holding tray where 
they were available during the day to 
approximately 150 staff. At night they 
were locked in a cabinet, but the keys 
were kept in an unlocked desk drawer. 
The first employee who needed the set 
in the morning could unlock the cabinet 
and put the fiche in the tray. It was never 
determined who put out the set on the 
day the loss was discovered. The 38 
fiche were never recovered. 


It became apparent that employees 
could remove fiche from the set and 
take them to other parts of the floor 
without completing a log. Only 
employees from outside that work area 
were required to log out fiche. 


The investigators considered that 
Revenue Canada’s security was ade- 
quate for the production and distribu- 
tion of the microfiche and that staff are 
highly security conscious. However, 
once inside a secure area, employees 
appeared to overlook the need to pro- 
tect personal information as evidenced 
by the cabinet key in an unlocked desk 
drawer. Employees also knew little or 
nothing about the Privacy Act and the 
obligations it imposes on employees 
handling personal information. 


Following the incident, the office institu- 
ted new strict procedures. The set of 
fiche and readers are now kept and. 
used in a secure room which is staffed 
while open. Sheets must be logged as 
used and the set then returned to a 
locking cabinet. Stringent controls are 
now in place for destruction of old fiche. 


These new controls make redundant 
any recommendations to increase secu- 
rity in the Calgary unit. However, the 
Commissioner recommended that other 
locations review their storage and 
microfiche handling to ensure com- 
pliance with both the Privacy Act and 
the new government security policy. As 
well, several recommendations made 
after the previous microfiche theft 
(Annual Report 1986-87) from the 
Toronto office were repeated: 


* employees should be made aware of 
their obligations to protect personal 
information under the Privacy Act; 


* microfiche should be given even more 
stringent protection than paper files and 


* staff should have access to microfiche 
only as they need to know. 


In the second incident, Correctional 
Service Canada lost more than 30 
boxes of outdated inmate files which 
were being shipped to the National 
Archives Records Centre in British 
Columbia. After almost two weeks of 
searching, the trucking company found 
the boxes in its warehouse. There was 
no evidence that the boxes had been 
opened. However, standard security 
precautions could have prevented the 
incident. 


The Audits 


Two of this year’s audits revealed a 
potential glitch which generated dis- 
cussion between the Commissioner’s 
office and the organizations being 
audited. Canada Post and the Export 
Development Corporation (both Crown 
corporations) are subject to the Privacy 
Act but technically are not bound by 
the federal government security policy. 
Both corporations have opted into the 
national interest provisions of the 
policy, but objected to the office using 
it as a standard against which to 
measure their physical security. 


The Commissioner does not believe 
that Crown corporations should be 
bound necessarily by the policy but 
considers the government standards a 
reasonable measurement against 
which to assess the corporations’ 
security. 


Canada Post 
The auditors travelled to Ottawa Head 


Office and divisional headquarters in 
Edmonton, London, and Quebec City. 
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Findings 


Staff Awareness: As in most govern- 
ment institutions audited, the staff did 
not understand their own or others’ pri- 
vacy rights, nor their responsibilities 
under the Privacy Act. Canada Post 
publishes periodic reminders in its 
internal bulletins, but most staff could 
not recall such material. Thus, either. 
the information is not distributed 
widely enough or it is simply having 
little impact. 


Canada Post plans a communications 
program to support its corporate policy 
on the protection of personal 
information. 


Personal Information Index 
Descriptions: 


1.) The description of two Human 
Rights banks (CPC/P-PU-096 and 
P-PE-809) contained no reference to 
personal harassment cases found in 
the files. The bank description will be 
changed to incorporate a reference to 
the material. 


2.) Change of address cards are now 
described as being a “class” of per- 
sonal information. However, the 
Privacy Act requires that personal 
information used for an administrative 
purpose be included in an information 
“bank”. Since the cards are used to 
redirect customers’ mail (an adminis- 
trative purpose) Canada Post will 
create a new bank to contain address 
change notices. A second bank has 
been established (CPC/P-PU-120) for 
requests from other departments to 
find individuals who owe Crown debts. 


Protection of personal information: 
Divisional headquarters employees 
who want to review their personnel files 
must apply through their supervisors 
and then examine the files in their pres- 
ence. This means supervisors have 
access to all personal information in an 
employee's file—including such details 
as medical history, charitable contribu- 
tions and marriages. This information 
is unnecessary to supervision. Canada 
Post will review and correct its access 
procedures. 


Some headquarters personnel files 
contained limited information on other 
employees, usually in lists containing 
names and social insurance numbers. 
Information about third parties will be 
removed as the files are drawn and 
used. 


In Edmonton, auditors found waste 
paper containing personal information 
being sent for disposal to a private 
company where it was stored outside 
and unsecured. Canada Post will ask 
National Archives to provide secure 
disposal of sensitive waste wherever 
possible. Elsewhere it will dispose of its 
own material. 


The auditors also found problems with 
disposal of other waste materials and 
control of cabinets or rooms containing 
personal files. Canada Post is commit- 
ted to correcting these problems when 
it implements its new privacy and secu- 
rity policies. 


At Ottawa and Edmonton, personal 
information from the Risk Management 
Claims bank is shared with private 
insurance adjusters. However, no for- 
mal agreement exists with the com- 
pany to ensure protection of informa- 
tion according to the Privacy Act. 
Canada Post will obtain insurance 
adjusters’ undertakings to meet both 


the spirit and intent of the act. It will 
also determine whether Canada Post 
should incorporate privacy and secu- 
rity provisions in contracts with all 
agents collecting or receiving personal 
information on its behalf. 


Improper use of personal information: 
Investigators found a human rights 
training manual which included actual 
grievance files, complaints and investi- 
gation reports. The documents have 
now been made anonymous. 


improper disclosure of personal infor- 
mation: Canada Post shared on one 
occasion its mailing list of stamp 
collecting customers with the Royal 
Canadian Mint “and other reputable 
mailers”. Canada Post considered this 
a “consistent use” of the information. 
The Commissioner did not see a reas- 
onable connection between collecting 
stamps and collecting coins or other 
items. The exchange has already been 
stopped. 


Retention and Disposal Schedules: 
Auditors made several recommenda- 
tions about storage or disposal of per- 
sonal records that were being kept 
either too long, or not long enough 
(the act requires personal information 
be kept at least two years). Canada 
Post will take action on each of the 
recommendations. 


Finally, auditors found fingerprints in 
personnel files in each division they 
visited. Apparently Canada Post once 
took fingerprints routinely from all 
employees. The Commissioner sugges- 
ted that prints no longer needed should 
be returned to the individuals. Those 
still needed might better be stored in 
security clearance or reliability 

check files. 


Pension Appeals Board 


The Pension Appeals Board hears 
appeals against decisions of the 
Canada Pension Plan and the Quebec 
Pension Plan. All the files are held in 
Ottawa and all personal information is 
on paper. There are no EDP files. 


Findings 


Awareness: Board staff knew little 
about the Privacy Act. Management 
will provide the necessary training. 


Personal Information Index Descrip- 
tions: The Index incorrectly says that 
the Privacy Act does not apply to any 
material the board holds about appeals 
under the Quebec Pension Plan. All 
personal information under the board’s 
control is subject to the Privacy Act 
and the board will remove the state- 
ment from the listing. 


Auditors found that the Employee 
Records bank (PAB/P-PE-801) is held 
and controlled by Health and Welfare 
Canada (HWC), and not the board. The 
description will be moved to HWC’s 
listing and a statement included under 
the board’s listing directing employees 
to Health and Welfare. The board also 
intends to create a bank called “Staff 
Matters” in which it will hold routine 
staff material. 


Protection of Personal Information: 
During the audit investigators found 
keys left in the locks of cabinets 
containing completed files. The cabi- 
nets are in the main office and acces- 
sible to cleaning staff during the even- 
ing. The Board will ensure that keys 
are removed. Investigators also 
recommended new destruction proce- 
dures for sensitive waste. 
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Retention and Disposal: There is no 
retention and disposal schedule for 
appeals files, some of which date from 
1967. The Board will seek National 
Archives advice on establishing a 
proper schedule. 


Collection of Personal Information: 
Investigators found that the board 
receives all Canada Pension Plan 
Review Committee decisions and sup- 
porting evidence, whether or not an 
appeal has been filed. When there is no 
appeal, the board returns the evidence, 
but retains the decision. The Commis- 
sioner considers this to be collection of 
information outside the mandate of the 
board. The board will change its 
process for examining review commit- 
tee files. 


Science Council of Canada 


The Science Council of Canada 
assesses Canada’s scientific and tech- 
nological resources, needs and poten- 
tial and has a mandate to increase 
public awareness about science and 
technology. 


All files are kept in the Council’s office 
in Ottawa. No personal information is 
stored electronically or on microfiche. 


Findings 


Awareness: Science Council staff were 
generally aware of privacy principles — 
a rare finding among government insti- 
tutions. In fact, the Council has 
conducted research into privacy- 
related matters. 


Security of Personal Information: Audi- 
tors found staff members who handle 
personal information have not been 
checked for reliability, as required by 
the government security policy. The 
Council undertook to screen all 
employees who use protected 
information. 


Cleaning staff is allowed into the per- 
sonnel office unescorted after hours. 
No one checks to ensure that the door 
is locked after cleaners leave. The 
Council will instruct commissionaires to 
make such checks. 


Index Bank Descriptions: Two groups 
of files containing personal information 
about contract personnel and Council 
members are not described in the Per- 
sonal Information Index. The Council 
will describe these holdings in the next 
edition of the Index. 


Department of Finance 


The department implements financial 
and economic policies and programs. 
Its offices and some 800 employees are 
in Ottawa. 


Findings 


Awareness: Once again, employees 
interviewed demonstrated little know- 
ledge of the Privacy Act, though the 
department developed procedures on 
the Act in 1983 and has since provided 
periodic briefings. Management is 
developing new procedures and guide- 
lines which will be distributed to the 
administrative branch and the office of 
each assistant deputy minister. 


Protection of Personal Information: 
Auditors found that both supervisors 
and official languages training staff 
who had no real need to know were 


able to review complete personnel files. 
Moreover, some files contained limited 
information about other employees. 
One of the files examined contained a 
derogatory assessment of another 
employee. 


The department is determining how it 
could sever sensitive information from 
these files without hindering supervi- 
sors and language staff from discharg- 
ing their responsibilities. 


Keys to cabinets were kept in unlocked 
drawers in nearby desks and waste 
personal information was found in 
regular garbage cans or recyclable- 
paper bins. 


The keys will now be kept personally 
by the responsible staff member and 
“burn” bags will be provided for disposal 
of personal information. 


Investigators suggested that the cabi- 
net and room containing records of 
requests under the Access to /nforma- 
tion Act and Privacy Act be locked 
when unattended. The department 
agreed. 


Personal Information Index Descrip- 
tions: The department maintains 
records from reliability checks on its 
employees but does not list the infor- 
mation in the Personal Information 
Index. This effectively prevents 
employees from asking to see the 
information since they may not realize 
it is available. 


Treasury Board has amended the 
description of this bank (one of the 
standard banks kept by all depart- 
ments). The department will use Trea- 
sury Board’s description. 


Ministry of the Solicitor 
General—Secretariat 


The Secretariat supports the Solicitor 
General whose responsibilities include 
the Royal Canadian Mounted Police, 
Canadian Security Intelligence Service, 
Correctional Service of Canada and the 
National Parole Board. Auditors visited 
the Secretariat's head office in Ottawa. 


Findings 


Protection of Personal Information: 
Auditors found many of the same defi- 
ciencies identified in other agencies: 
detailed personnel files available to 
supervisors; lists of employees, some 
with social insurance numbers, in 
others’ personnel files; files in locked 
cabinets—but keys in nearby unlocked 
desk drawers; personal information in 
regular garbage and cabinets left 
unlocked when offices are not staffed. 
As well, file covers for records in the 
Employee Personnel Record bank had 
neither a security classification nor 
“Protected” designation. 


The Secretariat agreed to examine the 
problem of limiting access to personnel 
files. It will also remind staff about their 
security responsibilities. “Protected” 
folders are now used for new personnel 
files (or when requested) though the 
secretariat does not consider it feasible 
to convert all existing files. 


Personnel files containing sensitive 
personal information should be marked 
appropriately because the investigation 
found that some information had been 
revealed “outside the organization that 
created or collected it”. 
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Although the Secretariat has an ade- 
quate security procedure, investigators 
witnessed the offices left open and 
unstaffed. 


improper Use of Personal Information: 
A human resources desk manual uses, 
as examples, copies of actual com- 
pleted forms and memoranda. The 
material identifies individuals. Mana- 
gement agreed to remove the identi- 
fying information. 


Retention and Disposal of Personal 
information: Employee personnel 
records and RCMP personnel and 
administrative records were retained 
beyond the approved period. The 
National Security Records bank 
(P-PU-026) had no disposal schedule. 
The Secretariat agreed to review per- 
sonnel files annually and consult with 
National Archives and the Canadian 
Security Intelligence Service on dis- 
posal of the other files. 


Personal Information Index Descrip- 
tions: Records of employee reliability 
checks are included in the secretariat’s 
Security Clearances bank (P-SE-909) 
but are not described. Several banks 
have a National Archives approval 
number without the listing describing 
how long information is kept. Reliabil- 
ity checks will be included in the new 
standard bank created by Treasury 
Board. This bank, and disposal sched- 
ules for other banks, will be described 
in the next edition of the Index. 
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An Old Issue: In 1986 the deputy solici- 
tor general agreed to purge personal 
information from the files in one of the 
secretariat’s banks, Protection of 
Privacy (P-PU-035). The bank was then 
to be removed from the Index. During 
the audit, investigators found that the 
bank continues to be listed and only 
200 of the 600 files have been purged. 
The Secretariat has assured the Com- 
missioner that the task will be com- 
pleted by September 1989. 


Employment and Immigration 
Canada (EIC) 


The Internal Audit 


This audit was divided into two parts . 
The first was done by EIC’s own in- 
ternal audit bureau and focussed on 
protection of personal information 
about EIC clients. The Privacy Com- 
missioner’s role was to “audit the audi- 
tors”. During the next two years the 
internal audit bureau will examine its 
personnel information banks and 
information in EDP files. 


The second part, conducted by the 
Privacy Commissioner's office, was of 
EIC’s Employee Assistance Program 
(EAP) files. 


The internal audit’s objective was broa- 
der in scope than those done by privacy 
auditors because EIC assessed the 
effectiveness of its internal administra- 
tion and structures in dealing with both 
the Privacy Act and the Access to 
Information Act. 


In an internal audit the Commissioner 
provides overall advice, when needed, 
and comments or makes recommenda- 
tions on the department's compliance 
with the Privacy Act’s rules concerning 
collecting, using, maintaining, disclos- 
ing and disposing of personal 
information. 


Employment and Immigration, one of 
the largest federal government depart- 
ments, provides employment counsel- 
ling, training and referrals to millions of 
Canadians, administering the Unem- 
ployment Insurance Plan and screening 
and providing services to immigrants. 


“The need for privacy protection is 
obvious. The whole of EIC, with its 800 
offices, is a veritable repository of per- 
sonal information. EIC runs on perso- 
nal information”, concluded the inter- 
nal audit report. The Privacy 
Commissioner couldn’t have put it 
better. 


Findings 


Staff Awareness: EIC auditors found 
privacy coordinators knowledgeable 
about the Privacy Act but other staff 
were not as well informed. As a result, 
there were inconsistencies in handling 
informal requests or requests from 
third parties such as provincial 
governments or advocacy groups. EIC 
has given priority to producing opera- 
tional manuals for staff and will sup- 
plement these with training throughout 
the department. 
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Collection and Use of Information: The 
auditors found that a number of forms 
which collect personal information 
contain incomplete references to the 
Privacy Act. They suggested improving 
the privacy notice on the forms by 
adding descriptions of the data and 
listing the ways it is used, the bank in 
which it is kept and the organizations 
with which it is shared. They also 
recommended improving the descrip- 
tion of the Unemployment Insurance 
Claim File bank in the Personal Infor- 
mation Index because it may not ade- 
quately describe all of the data in the 
files. 


To ensure that its forms comply with 

the Privacy Act, EIC will ask program 
staff to refer forms which collect per- 
sonal information to the Public Rights 
Administration Directorate for advice. 


Data Matching: EIC shares (or 
matches) more information with other 
agencies than perhaps any other 
federal department. Matches include 
comparisons with Revenue Canada, 
Taxation data to ensure that individuals 
are reporting earnings and that those 
collecting unemployment insurance are 
not also working. The matches are car- 
ried out under the Unemployment 
Insurance Act and the [Immigration Act. 


The Privacy Act also allows matching 
by “an agreement or arrangement” 
between government agencies and 
with other governments, whether 
Canadian or international, in order to 
administer or enforce a law or carry out 
an investigation. 


The internal auditors found that not all 
matches are governed by written 
agreements and that a portion of the 
agreements have been in effect too 
long to reflect current legislation. 
Without formal agreements, staff have 
insufficient guidance on what informa- 
tion can be shared and how it can be 
used. The auditors recommended pro- 
viding summaries of agreements to | 
operational staff, completing all pend- 
ing agreements and then conducting a 
follow-up audit to ensure that EIC 
complies with the new Treasury Board 
data matching policy. 


EIC will review all agreements and 
complete those still being considered. 
As well, it will report all current data 
matches to the Privacy Commissioner 
and ensure that they all are listed in the 
Personal Information Index. (The new 
Treasury Board matching policy 
requires all departments to advise the 
Privacy Commissioner's office 60 days 
ahead of any new matches.) 


Security: EIC auditors found that some 
service contracts with private com- 
panies do not contain privacy or secu- 
rity clauses, meaning that the compa- 
nies may not always treat personal data 
in confidence. Auditors cited examples 
of companies or individuals providing 
services such as transportation, docu- 
ment shredding, office cleaning (partic- 
ularly in offices with open shelving), 
interpretation, transcription, EDP and 
psychological diagnosis. 


Auditors recommended revising re- 
gional contracts to include clauses to 
protect personal information according 
to the requirements of the Privacy Act, 
the security policy and EIC’s own 
regulations. 
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Disposal of personal information: 
Clearly there was no consistent dis- 
posal of waste personal documents 
among EIC offices. Auditors found that 
some sorted waste for shredding or 
regular garbage; others simply put it 
out with disposable material from other 
building tenants. Since local office staff 
estimate that as much as 90 per cent of 
waste is personal information, auditors 
questioned the need to sort. The audi- 
tors also found that no single unit 
ensures that all microfiche are 
accounted for and eventually 
destroyed. The procedures varied from 
sending old fiche to regional offices, 
regional computer centres or to 
National Archives. The auditors sug- 
gested a standard procedure for even- 
tual destruction of out-of-date fiche. 


EIC’s Security Task Force will address 
both the incorporation of security 
clauses in service contracts and the 
control and destruction of microfiche 
in its workplan. 


Employee Assistance Files (EAP) 


These files are among the most sensi- 
tive personal files kept by government, 
recording personal information of indi- 
viduals undergoing counselling for 
health or behavioural problems. The 
files are seen only by the employee and 
the counsellor. Theft or unauthorized 
release could cause the employee irre- 
parable harm. 


As a result, auditing EAP files poses its 
own problems for both the department 
and the Privacy Commissioner. The 
Commissioner is torn between needing 
to ensure that the information is seen 
by as few as possible but requiring evi- 
dence that it is appropriately collected 
and protected. Thus, the auditor exa- 
mines randomly selected anonymous 
files to determine whether the informa- 
tion meets privacy standards for collec- 
tion, use, retention, disclosure and 
disposal. 


In ElC’s case there were no EAP files in 
the Ottawa office. EIC’s policy is to 
maintain as little information as possi- 
ble, passing necessary details on to 
outside counsellors. The decision not 
to maintain files is understandable, 
even commendable, as a method of 
ensuring client confidentiality. But the 
practice means there is no documen- 
tary evidence of uses of the informa- 
tion, nor that the client has consented 
to its release. 


The Commissioner observed that the 
department has to make a trade-off 
between restricting the amount of sen- 
sitive personal information in files and 
the need for operational controls. He 
proposed that EIC re-examine its cur- 
rent procedures. 


Auditors made several suggestions for 
improving physical security of the 
unit’s records and disposal of waste 
containing personal data. The Com- 
missioner recommended that EIC also 
make the improvements in the regional 
offices that kept files. 
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Notifying the Commissioner 


Generally, the Privacy Act prohibits 
federal government agencies from 
releasing personal information to 
anyone other than the individual 
concerned. As with most rules, there 
are exceptions. In fact, the Act has 13 
— from releases to comply with a war- 
rant or subpoena, to helping validate 
aboriginal peoples’ claims or 
grievances. 


Among those exceptions are two which 
require the government agency to 
notify the Privacy Commissioner. The 
first covers releasing information “in 
the public interest” or to benefit the 
individual concerned. The notification 
gives the Commissioner an opportunity 
to advise the individual of the release if 
that is considered necessary. The 
second exception deals with releases 
for a use “consistent” with the purpose 
for which it was originally collected 
(but not described in the Personal 
Information Index). 


The Privacy Act does not providea 
means for the Commissioner or the 
individual to block release. The Access 
to Information Act gives third parties 
the right to court action to prevent the 
release of corporate information. The 
Privacy Commissioner believes that 
individuals too should be able to pre- 
vent the release of what they consider 
to be unwarranted and damaging 
release. 
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There were early suspicions that these 
exceptions to the general rule prohibit- 
ing the disclosure of personal informa- 
tion to third parties would prove to be 
the Privacy Act “Mack truck” clause. It 
was feared that there would be a full- 
scale release of personal information 
based on broad interpretations of 
“public interest” and “consistent” use. 
To prevent such abuse, the Commis- | 
sioner itemized all uses of these 
releases in his annual report. 


So far no abuse has been evident. 
While the office continues to examine 
each notification, beginning this year, 
only global statistics and select ex- 
amples for illustrative purposes are 
reported. A detailed breakdown of the 
24 notifications can be obtained from 
the Privacy Commissioner's office. 


The MPs — again 


Once again Employment and Immigra- 
tion Canada (EIC) advised the Privacy 
Commissioner how it would handle 
MPs’ requests for personal information 
about constituents during the federal 
election campaign. 


The Privacy Act allows government 
agencies to release personal informa- 
tion to an MP who is trying to help 
solve a constituent’s problem. Once 
Parliament is dissolved, however, MPs 
have only the status of ordinary citi- 
zens. This means, according to the let- 
ter of the law, that MPs may no longer 
(without the individual’s consent) 
inquire on behalf of a constituent about 
foul-ups with a government agency 
since this would require them to see 
personal information. 


es eee 


It seems doctrinaire to impede MPs 
seeking to help constituents while in 
the legal limbo of an election period. 
On the other hand, other candidates 
may feel unfairly disadvantaged due to 
the incumbent’s special access to 
government information. ElIC — the 
department most affected — advised 
the Privacy Commissioner that during 
the election period it would once again 
release information without consent to 
former MPs since it “would clearly 
benefit” the person concerned [para- 


graph 8(2)(m)(ii)]. 


The Privacy Commissioner agreed to 
the solution — the same one used 
during the 1984 election. But he re- 
peated his concern that delegating the 
discretion to disclose personal 
information to “any” EIC officer or 
employee increased the opportunity for 
abuse. Privacy staff reviewed 1479 such 
notifications during the election 
Campaign. 


The Privacy Act should be amended 
before the next election to clarify 
whether, during an election period, 
incumbent MPs should maintain their 
special access to government informa- 
tion when helping a constituent. 


Breach of dog’s quarantine period 


Canada Post advised the Privacy 
Commissioner that it had given an 
Agriculture Canada veterinarian the 
address change of a woman who 
appeared to have breached her dog’s 
six-month quarantine period. The dog 
had been in contact with a rabid animal 
and had not completed the required 
treatment. 


The post office reached the woman 
directly but she did not cooperate. 
Although the Animal Disease and Pro- 
tection Act does not authorize release 
of the information, Canada Post . 
concluded the disclosure was in the 
public interest. The Commissioner did 
not question the release. 


Inmates’ names and addresses to 
Chief Electoral Officer 


Following a Manitoba Court decision 
that inmates had the right to vote in the 
federal election, Correctional Service 
Canada advised the Commissioner that 
it would give the names and addresses 
of all federal inmates in Manitoba to the 
Chief Electoral Officer of Canada. 


The list was to be used by returns offi- 
cers to organize the voting in peniten- 
tiaries and was not to be given to 
anyone else. However, since the court 
decision was appealed, the inmates 
were not enumerated and the list was 
not sent. 
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Soviet government alerted to visitor 
with TB 


External Affairs advised the Privacy 
Commissioner that it had notified 
Soviet public health authorities about a 
Canadian visitor with an infectious 
disease. 


Health and Welfare Canada had 
warned External Affairs that a woman 
with pulmonary tuberculosis had re- 
fused medication and checked herself 
out of the hospital. She then travelled 
to the Soviet Union to visit relatives. 
After calling the Privacy Commis- 
sioner’s office, External informed the 
Canadian embassy in Moscow which, 
in turn, notified the Soviets. 


The notification was considered “in the 
public interest”. 


92 


Spreading the Word 


It has been said that if there were a pri- 
vacy constituency in Canada — a 
group of knowledgeable, committed 
privacy activists — it would fit in the 
Privacy Commissioner’s boardroom (a 
snug fit even for the Commissioner's 
own staff). 


The job is no longer so lonely. In fact, 
two recent conferences on privacy 
(and access to information) filled large 
meeting rooms in Toronto and Ottawa 
hotels. A loose network of federal, pro- 
vincial and unaligned privacy advo- 
cates is emerging, allied with commit- 
ted records and EDP systems 
managers to spread the word. 


The public may still be puzzled when 
told of a Privacy Act (and find it faintly 
hilarious that there is a Privacy Com- 
missioner). Nevertheless, people 
understand the issues and find them 
deadly serious. 


The Commissioner and his staff wel- 
come opportunities to discuss the Act 
and the issues. During the year the 
Commissioner completed a series of 
some 20 speeches to Canadian Clubs 
across the country, spoke to (among 
others) trainee intelligence officers, 
data processors, heads of federal 
government agencies and middle level 
financial managers. He also participa- 
ted in a Canadian Chamber of Com- 
merce briefing on the implications for 
the private sector of privacy legislation 


and the OECD guidelines; and on AIDS 


at a National Parole Board seminar. 


The Commissioner began a series of 
visits to federal penitentiaries to dis- 
cuss the Privacy Act with staff and 
inmates. So far he has visited the 
Prison for Women in Kingston and the 
medium security institution at Spring- 
hill, Nova Scotia. 


a 


The Commissioner's staff continues to 
brief participants on the government’s 
management training courses and 
spoke to Coast Guard staff in Halifax, a 
race relations seminar in Montreal, and 
college classes in Toronto and Ottawa. 


The office produced an information 
package entitled “Do you need help 
using the Privacy Act?” It includes a 
poster, bookmark and an explanatory 
brochure describing the Commis- 
sioner’s role and how to use the office’s 
services. | 
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Corporate Management 


Corporate Management provides both 
the Information and Privacy Commis- 
sioners with financial, personnel, 
administrative, data processing and 
library services. 


Finance 


The Offices’ total resources for the 
1988-89 fiscal year were $5,074,000 and 
69 person-years, an increase of 
$1,152,000 and 11 person-years over 
1987-88. Personnel costs of $3,837,201 
and professional and special services 
expenditures of $702,567 accounted for 
more than 88 per cent of expenditures. 
The remaining $603,137 covered all 
other expenses. 


Personnel 


A substantial increase in person-years 
for the Privacy Commissioner pro- 
duced a very active personnel program. 
New positions were classified and there 
were 42 staffing actions including two 
senior management appointments. In 
addition, the offices underwent a bien- 
nial classification audit by Treasury | 
Board and the PM (program manage- 
ment) and IS (information services) 
positions were reviewed in line with the 
new classification standards. 


The following are the Offices’ expenditures for the period of 
April 1, 1988, to March 31, 1989. 


Information 
Salaries $ 1,268,673 
Employee Benefit 
Plan Contributions 202,500 
Transportation and 
Communication 29,363 
Information 57,681 
Professional and 
Special Services 506,936 
Rentals 2,898 
Purchased Repair 
and Maintenance ast 
Utilities, Materials 
and Supplies 9,957 
Acquisition of 
Machinery and 
Equipment 43,232 
Other Payments 1,630 
TOTAL $2,124,207 
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Corporate 

Privacy Management Total 
$1,469,048 $568,480 $3,306,201 
246,600 81,900 531,000 
66,204 118,094 213,661 
38,815 1,526 98,022 
144,959 50,672 702,567 
64 5,294 18,256 
5 lAa2 21,940 28,389 
14,738 37,264 61,959 
85,986 48,464 177,682 
1,569 1,969 5,168 
$2,073,095 $ 945,603 $5,142,905 


Administration 


The offices moved to the 3rd and 4th 
floors of Tower B, Place de Ville. 
Improved security measures were 
implemented for the new premises and 
a security manual was prepared. In 
addition, National Archives completed 
a records management audit. 


Informatics 


A review of informatics was undertaken 
with the assistance of outside consul- 
tants. The office will implement the 
major recommendations of the study 
concerning renewal of the case man- 
agement system and expansion of 
report and text production facilities. 


Library 


The library continues to provide an 
information and referral service for 
both Commissioners. It offers a full 
range of library services, including 
interlibrary loan, automated reference, 
and literature’searches. 


Last year, approximately 500 publica- 
tions about access to information, the 
protection of privacy and the ombuds- 
man function were added to the li- 
brary’s inventory. The public is wel- 
come to consult our collection, which 
also includes newspaper clipping files, 
periodicals, and annual reports. 
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Appendix Il 


Government Institutions 
Covered by the Act 


Advisory Council on the Status of 
Women 


Agricultural Products Board 

Agricultural Stabilization Board 

Agriculture Canada 

Atlantic Development Council 

Atlantic Pilotage Authority 

Atomic Energy Control Board 

Bank of Canada 

Bilingual Districts Advisory Board 

Board of Trustees of the Queen 

Elizabeth Il Canadian Fund to 
Aid in Research on the Diseases of 
Children 

Bureau of Pension Advocates 


Canada Council 


Canada Deposit Insurance 
Corporation 


Canada Employment and Immigration 
Commission 


Canada Labour Relations Board 
Canada Lands Company Limited 


Canada Mortgage and Housing 
Corporation 


Canada-Newfoundland Offshore 
Petroleum Board 


Canada-Nova Scotia Offshore 
Petroleum Board 


Canada Ports Corporation 
Canada Post Corporation 
Canadian Aviation Safety Board 


Canadian Centre for Occupational 
Health and Safety 


Canadian Commercial Corporation 


Canadian Cultural Property Export 
Review Board 


Canadian Dairy Commission 


Canadian Film Development 
Corporation 


Canadian Government Specifications 
Board 


Canadian Grain Commission 
Canadian Human Rights Commission 


Canadian Institute for International 
Peace and Security 


Canadian International Development 
Agency 


Canadian International Trade Tribunal 
Canadian Livestock Feed Board 


Canadian Patents and Development 
Limited 


Canadian Penitentiary Service 
Canadian Pension Commission 


Canadian Radio-television and 
Telecommunications Commission 


Canadian Saltfish Corporation 
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Canadian Security Intelligence 
Service 


Canadian Unity Information Office 
The Canadian Wheat Board 
Communications, Department of 


Consumer and Corporate Affairs 
Canada 


Defence Construction (1951) Limited 
The Director of Soldier Settlement 
The Director, The Veterans’ Land Act 
Economic Council of Canada 
Employment and Immigration Canada 
Energy, Mines and Resources Canada 
Energy Supplies Allocation Board 
Environment Canada 

Export Development Corporation 
External Affairs Canada 

Farm Credit Corporation 

Federal Business Development Bank 


Federal Mortgage Exchange 
Corporation 


Federal-Provincial Relations Office 
Finance, Department of 

Fisheries and Oceans Canada 
Fisheries Prices Support Board 


The Fisheries Research Board 
Canada 


Freshwater Fish Marketing Corporation 


Grain Transportation Agency 
Administrator 


Great Lakes Pilotage Authority, Ltd. 


Hazardous Materials Information 
Review Commission 


Health and Welfare Canada 


Historic Sites and Monuments Board 
of Canada 


Immigration and Refugee Board 
Indian and Northern Affairs Canada 


International Development Research 
Centre 


Investment Canada 


Jacques Cartier and Champlain 
Bridges Incorporated 


Justice Canada 

Labour Canada 

Laurentian Pilotage Authority 

Law Reform Commission of Canada 
Medical Research Council 


Merchant Seamen Compensation 
Board 


Metric Commission 

National Archives of Canada 

National Arts Centre Corporation 
The National Battlefields Commission 


National Capital Commission 
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National Defence 
National Design Council 
National Energy Board 


National Farm Products Marketing 
Council 


National Film Board 

National Library 

National Museums of Canada 
National Parole Board 
National Parole Service 


National Research Council of 
Canada 


National Transportation Agency 
(formerly Canadian Transport 
Commission) 


Natural Sciences and Engineering 
Research Council 


Northern Canada Power Commission 
Northern Pipeline Agency 

Northwest Territories Water Board 
Office of the Auditor General 

Office of the Chief Electoral Officer 


Office of the Commissioner of Official 
Languages 


Office of the Comptroller General 


Office of the Coordinator, Status of 
Women 


Office of the Correctional Investigator 


Office of the Custodian of Enemy 
Property 


Office of the Director of Investigation 
and Research 


Office of the Inspector General of the 
Canadian Security Intelligence Service 


Office of Privatization and Regulatory 
Affairs 


Office of the Superintendent of 
Financial Institutions Canada 


Pacific Pilotage Authority 

Pension Appeals Board 

Pension Review Board 

Petroleum Compensation Board 
Petroleum Monitoring Agency 

Prairie Farm Assistance Administration 


Prairie Farm Rehabilitation 
Administration 


Privy Council Office 

Public Service Commission 

Public Service Staff Relations Board 
Public Works Canada 

Public Works Land Company Ltd. 


Regional Development Incentives 
Board 


Regional Industrial Expansion 
Revenue Canada 


Royal Canadian Mint 


Royal Canadian Mounted Police 


Royal Canadian Mounted Police 
External Review Committee 


RCMP Public Complaints 
Commissioner 


The St. Lawrence Seaway Authority 
Science and Technology Canada 
Science Council of Canada 


The Seaway International Bridge 
Corporation, Ltd. 


Secretary of State 


Security Intelligence Review 
Committee 


Social Science and Humanities 
Research Council 
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Solicitor General Canada 
Standards Council of Canada 
Statistics Canada 

Statute Revision Commission 
Supply and Services Canada 
Tax Review Board 

Transport Canada 

Treasury Board Secretariat 
Veterans’ Affairs Canada 

War Veterans Allowance Board 


Yukon Territory Water Board 
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Ce 


The Privacy Act provides individuals 
with access to their personal information 
held by the federal government; it 
protects individuals’ privacy by limiting 
those who may see the information; and 
it gives individuals some control over 
the government's collection and use of 
the information. 


The Act sets out the principles of fair 
information practices, requiring 
government to : 


¢ collect only the information needed to 
operate its programs; 

¢ collect the information directly from 
the individual concerned, whenever 
possible; 

e tell the individual how it will be used; 

e keep the information long enough to 
ensure an individual access; and 

e “take all reasonable steps” to ensure 
its accuracy and completeness. 


Individuals in Canada may complain to 
the Privacy Commissioner if: 


e they are denied any part of the 
information; 

e they are denied their request to 
correct some of the information on 
the file— or their right to annotate it; 

e the department takes longer than the 
initial 30 days or maximum 60 days 
to provide the information; 

e the Info Source description of the 
contents of the information bank is 
deficient in some way; 

e the department's listing in the Source 
does not describe all the uses it 
makes of personal information; 


e an institution is collecting, keeping, 
using or disposing of personal 
information in a way which 
contravenes the Privacy Act. 


The Privacy Commissioner's 
investigators examine any file (including 
those in closed banks) except 
confidences of the Queen’s Privy 
Council to ensure that government 
institutions are complying with the Act. 


The Act also gives the Privacy 
Commissioner the power to audit the 
way government institutions are 
collecting, using and disposing of 
personal information. 


New Conductor, Familiar Score 


This is the first annual report to 
Parliament in eight years to be 
submitted by anyone other than John 
Grace who, until June, 1990, was the 
sole person to have served as Privacy 
Commissioner of Canada since the 
office was established as a function 
separate from the Canadian Human 
Rights Commission in 1983. 


Mr. Grace completed his term of office 
in July of 1990 and assumed new duties 
as Canada’s Information Commissioner. 
He departed this office with a high 
reputation in several respects: first, as 
an ombudsman with an outstanding gift 
for resolving privacy problems and 
complaints; second, as an energetic and 
eloquent spokesman for the cause of 
protection of personal privacy, and third, 
as the respected leader of a small but 
highly-motivated staff of skilled 
investigators and auditors who reflected 
his abiding concern for this vital but 
embattled area of human rights. 


He also was ever alert to the new 
challenges to privacy protection which 
continue to arise with almost 
bewildering rapidity and number in a 
constantly-changing commercial and 
technological environment. 


Thus Mr. Grace has bequeathed to his 
successor the advantage of a smoothly- 
functioning organization. Many of the 
issues touched upon in this report were 
initiated prior to Mr. Grace’s departure. 


During the interval between the 
departure of the former commissioner 
and the confirmation of anewone,a _ 
period of some ten months, the duties of 
acting commissioner were performed by 
the executive director, Alan Leadbeater. 
He served with distinction in the difficult. 
dual role of both administrative head 
and ombudsman. 


The new commissioner, coming into 
office almost on the eve of this report, is 
acting in some senses as a Surrogate 
spokesperson for two predecessors, 
although he was, as assistant 
commissioner, the beneficiary of their 
experienced counsel and guidance. In 
fact, the ten months expended as 
assistant commissioner proved to be an 
invaluable introductory exposure to a 
field which is both complex and 
becoming more so. If the reader detects 
any diffidence in the tone of the 
observations, be assured it is 
attributable to the realization that the 
author still has much to learn. 


It may be small comfort to this neophyte 
that he is not alone. In fact, the privacy 
guard also changed in Ontario and 
Quebec during the year. Paul-André 
Comeau was appointed Quebec’s new 
Access and Privacy Commissioner and 
Thomas Wright was named Information 
and Privacy Commissioner of Ontario. 
One thing should not change—the 
cordial and mutually supportive 
relationship among these offices. 


—— ee 


This report, in attempting to give a 
reading on the state of privacy 
protection in the nation, will share with 
its predecessors something of the 
quality of a “good news-bad news” 
story. It is the nature of the issue that 
there will be no final victories. Personal 
privacy is a problem intimately bound up 
with the relationship of the individual to 
society, and so long as society 
continues to evolve and change, so too 
will the problems affecting privacy. 


There is no more fragile, yet important, 
right in today’s complex society than the 
right to a reasonable expectation of 
privacy. It is not a right, which some 
cynics suggest, that only serves those 
with something to hide. Without a 
meaningful measure of privacy our 
fundamental freedoms of expression, 
belief and association risk becoming 
meaningless. 


Justice Brandeis, in his famous 1898 
definition of privacy as “the right to be 
let alone”, could not have contemplated 
a world of ingenious machines with 
unlimited capacity for collecting, 
collating and transmitting information 
across global networks. Nor could he 
have foreseen a science capable of 
plumbing the deepest secrets of human 
heredity. 


The right to be left entirely alone, if it 
ever existed, could now be exercised, if 
at all, only, in the farthest corner of the 
most remote reaches of our arctic. 
Even then, one suspects, the putative 
recluse would sooner or later see some 
indomitable servant of a government 
department looming over the frozen 
horizon bearing the all-important form 
which, when properly filled out, would 
confer that indisputable certification of 
human existence, a Social Insurance 
Number. 


But if absolute privacy in modern society 
is neither attainable, practical nor even 
particularly desirable, the struggle must 
continue to preserve the individual’s 
right to decide the degree to which 
personal privacy is to be sacrificed on 
behalf of other competing rights and 
claims. 


So the notion of an annual fever-chart, 
while it provides a convenient method of 
keeping score, is to a certain extent 
misleading unless it is clearly 
understood that, where privacy is 
concerned, the patient will always be in 
danger since it is under assault from 
new afflictions as rapidly as remedies 
for older ones are found. 


One is struck by this phenomenon in 
reading past annual reports. Many of 
the issues which dominate privacy 
discussions today were barely in the 
privacy vocabulary eight short years 
ago. For example there is drug testing, 
AIDS testing, and implications of genetic 
research, interception of cellular 
telephone communications, to name but 
a few, and some of which will be 
referred to later in this report. Doubtless 
this will continue to be the experience in 
future, since there is no reason to 
believe there will be any relaxation in 
the onward march of science and 
technology. The best one can do is to 
stand firmly on the privacy ramparts, 
trying to dam the breaches as they 
occur, and confident of nothing except 
that it will be a never-ending struggle. 


So how did the struggle proceed in the 
year just past? 


Certainly there is no reason on the 
available evidence to suppose there has 
been any abatement in the 
technological onslaught against 
personal privacy. Computers continue 
to proliferate (80,000 in the possession 
of the federal government alone, at last 
estimate), the tide of junk mail continues 
to mount, the commercial trafficking in 
personal information continues to 
increase (a $3 billion annual business in 
the U.S., and, presumably, on the usual 
proportion, at least $300 million in 
Canada). 


But, on the proposition that an aroused 
and informed public is the best bulwark 
of privacy rights, there are very positive 
signs of real and lasting gains. 


In the marketplace 


Past reports have referred to the 
growing awareness of invasive 
marketing practices in the private 
sector. In 1990, the issue received the 
final accolade of media stardom—a 
TIME Magazine cover story. And 
although some of the participants might 
have wished otherwise, further proof of 
the rising profile of privacy issues 
emerged in the political arena in two 
provinces where ministers found 
themselves in difficulties over 
disclosures which, in two cases at least, 
led to a resignation. Whatever else one 
might think or say about them, these 
events underline that privacy rights 
cannot always be ignored with impunity. 
And, if the marketplace in recent years 
has generated some of the major 
threats to privacy, the marketplace 
acting in self-interest in the end may 
also prove to be at least partly a self- 
correcting mechanism. 
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Presumably in response to growing 
consumer concern, the private sector is 
showing (at long last, some might say) 
encouraging signs of action. During the 
past year, the Canadian Bankers 
Association, Bell Canada and the 
Canadian Direct Marketing Association 
have all produced codes offering 
significant improvements in the 
protection for privacy and confidentiality 
of information concerning their clients. 
These developments are discussed in 
more detail later in the report, but here it 
is worth noting that they offer some 
hope yet for the path of voluntary action. 


The issue now is not whether the private 
sector can continue without privacy 
codes, but how long it will be before 
compulsion in one form or another 
enters the equation. Thanks to 
developments in Europe, North 
American business may soon lose its 
ability to engage in data transfers with 
European business unless it has privacy 
codes in place. This development lends 
added urgency to the Commissioner’s 
recommendation to Parliament last year 
that the Privacy Act be amended to 
require all federally-regulated private 
sector firms to implement privacy codes 
based on internationally-accepted 
guidelines and principles. 


Even assuming such voluntary codes 
become a feature of the Canadian 
marketplace, there remains a question 
about their effectiveness. Highly- 
respected authorities believe some form 
of oversight is necessary before 
business becomes truly accountable to 
the public for protecting privacy. 


Dr. David Flaherty, the leading 
Canadian academic in the field of 
privacy research, argues that a federal 
audit power is required to ensure private 
sector compliance with its own voluntary 
codes. His is a view which must be 
respected, yet the Commissioner 
continues to hope (as did his 
predecessor) that such a degree of 
intervention (with the massive resources 
it implies) may be forestalled by the 
private sector demonstrating some good 
privacy citizenship. 


Certainly there remains a long way to 
go. Citing one small example, some 
chartered banks in their credit card 
applications still include in the fine print 
virtual absolute waivers of the privacy 
rights of customers. These waivers 
confer upon the banks the right to re- 
use, in any way they see fit, any or all of 
the information provided, such as 
salary, employment history, personal 
assets and in one case, the Social 
Insurance Number. A few sharp-eyed 
consumers have noted these waivers 
and drawn them to the attention of this 
office but most, we suspect, did not 
notice. Such fine-print caveats do not 
meet any reasonable definition of 
“informed consent’. Neither do they 
reflect the spirit of enhanced respect for 
privacy to which the chartered banks’ 
own association now lays claim. 


On the positive side, the Canadian 
Direct Marketing Association is 
commended for providing a process by 
which consumers may have their names 
removed from the mailing lists of their 
members. Since the association covers 
more than 80 per cent of the firms 
engaged in direct marketing, this is a 
forward step. 


Still, such modest improvements are in 
no way keeping pace with the exploding 
volume of information exchange made 
possible by the computer. Thus a 
minimum step to imposing some 
standards on the trade in personal 
information should be the introduction of 
a legislated requirement that all 
business under federal jurisdiction 
implement approved privacy codes. 
The Commissioner considers this 
urgent. 


Also needed is for Parliament to restore 
privacy to telephone communications in 
Canada, now eroding with the spread of 
cellular telephones. Cellular 
communications can and are being 
intercepted by easily available 
monitoring equipment. There seems no 
reason why the absence of conventional 
wires should deprive customers of the 
right and expectation of privacy. Sale or 
possession of monitoring equipment 
should be limited to authorized 
organizations for use only in conformity 
with laws governing surveillance 
activities. 


Appraising the manager 


Readers of last year’s report may recall 
the Commissioner’s cool reception of a 
proposed hotline for anonymous tips 
from public servants about government 
fraud, waste and mismanagement. 
Happily the idea was dropped. 


But many of the same privacy problems 
are inherent in a new management tool 
departments are taking up with 
enthusiasm—“reverse” or “upward” 
appraisals. As the terms imply, the 
process allows employees to evaluate 
their managers’ performance 
anonymously. Although it has been 
used by large private sector 
corporations, this is a novelty for 
government agencies which, as part of 
public service reform, now design their 
own appraisal systems. 


The process requires employees to 
complete a questionnaire, rating 
managers on their management skills 
and personal traits. The completed 
forms then are analyzed, sometimes by 
a private consultant, and summarized. 
Managers receive a copy but do not see 
individual employees’ ratings or 
comments. 


There are several privacy problems in 
the process—first is promising 
employees confidentiality to prevent 
reprisals. The Privacy Act gives 
individuals the right to see what others 
say or write about them. And so 
promising confidentiality to employees 
who complete the appraisals is 
misleading and hollow. 


In contrast, it is firmly established public 
service practice for employees to 
review, comment on and even (if they 
wish) appeal managers’ appraisals of 
their performance. 
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Second, the notion that privacy rights 
can be sidestepped by contracting out 
the process is dangerous and 
unsupportable. To accept such a view 
would mean that all government privacy 
objectives could be foresworn by turning 
personal information over to private 
contractors. The implications go well 
beyond concern that managers would 
lose their right of access and that the 
Act would not protect this highly 
personal information from improper use 
or disclosure. However, once hired, 
contractors are agents of the 
government and it retains “control” of 
the information, wherever it happens to 
be stored. 


Few would argue with government’s aim 
to improve management and 
accountability. But establishing a 
process which subverts its own 
legislation is hardly the proper weapon. 


A year at the office 


As it has in almost every year since the 
office was established, the number of 
complaints, investigations, and audits 
has increased. Although the details are 
compiled in separate chapters 
elsewhere in this report, the office is 
now working at full stretch and, general 
restraint notwithstanding, Honorable 
Members and Senators must 
understand that the obligations they 
have laid on the office under the Privacy 
Act can not be discharged at their 
present level of efficiency by the existing 
modest staff of 34 persons. 
Investigations now number more than 
1,200 a year, exceeding 100 per 
investigator. Any significant increase in 
this workload, which experience 
suggests is inevitable, simply cannot 
occur without sacrificing existing 
standards of service. 
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The compliance branch also had a busy 
year, but it is worth noting that after 
eight years of operation, it has managed 
audits in only about one-fifth of the 150 
federal departments and agencies 
covered by the Privacy Act. Clearly, if 
the reach of the Act is ever extended to 
include audit responsibilities in the 
private sector, the existing compliance 
branch of nine persons will be unequal 
to the task. 


On the research side, the major effort of 
the office during the previous year was 
a study of the privacy implications of 
drug testing. The study found that 
mandatory random drug-testing in the 
workplace was unjustified, and in some 
circumstances, probably illegal. The 
office notes with approval that the 
Department of Transport has modified 
to some extent its drug-testing plans, 
but disapproves of the Department of 
National Defence and at least one 
chartered bank going forward with drug- 
testing programs which constitute 
unwarranted breaches of personal 
privacy. This issue is discussed in 
greater detail in a separate chapter. 


Now in the final stages of preparation is 
a study on the implications of progress 
in genetic research and testing, a 
subject which holds the promise of even 
greater privacy problems than drug- 
testing. The report is expected to be 
published in late summer of 1991. 


Privacy and the Charter 


It is both fascinating and gratifying for a 
Privacy Commissioner to watch the 
Supreme Court of Canada fashion a 
prominent place for the right to privacy 
within the Canadian Charter of Rights 
and Freedoms. It is fascinating for the 
ups and downs of the saga — and 
gratifying for the overall growing 
strength of the right to privacy. 


Two previous annual reports followed 
this unfolding study. There is more to 
tell this year. 


On September 11, 1983, police seized 
2/78 pounds of marijuana from a vehicle 
and charged a number of individuals 
with conspiracy to import an illegal 
substance. The Crown’s case was 
based on 136 phone calls intercepted 
during an intensive investigation in 
widely separated areas of British 
Columbia. 


The police believed that the alleged 
conspirators used public pay telephones 
to conduct their affairs and so they 
installed listening devices on 20 public 
pay phones. Tape recorders were 
attached to pay phones on some 20 
occasions and left on automatic record 
overnight, intercepting and recording 
conversations of suspects and others. 
While the police obtained judicial 
authorizations for these wiretaps, none 
of the authorizations specifically allowed 
the bugging of pay phones. Rather, the 
authorizations employed a “basket 
Clause” giving police the authority to 
intercept communications at certain 
addresses and “...elsewhere in the 
Province of British Columbia resorted to 
by (the suspects)...”. 


The trial judge ruled that, in these 
circumstances, the judicial 
authorizations were invalid. In his view, 
the automatic monitoring of public pay 
phones when such monitoring is not 
specifically authorized by a judge, 
permits a dragnet type of investigation 
not contemplated by the Criminal Code 
He ruled the intercepted communication 
inadmissible and directed the jury to 
acquit the accused. 


The B.C. Court of Appeal saw it 
differently, reversed the trial judge’s 
decision and ordered a new trial. The 
Court of Appeal concluded that it was 
not necessary for the authorization to 
make specific reference to pay phones 
as long as any monitoring of pay 
phones was not indiscriminate. The 
Court of Appeal found that an 
intercepted communication itself could 
(by containing a suspect’s voice) 
provide evidence that the monitoring 
was not indiscriminate. 


The Supreme Court of Canada resolved 
the matter in a 4-2 decision, Thompson, 
et al v. The Queen, issued October 18, 
1990. The Supreme Court conclusion 
is most interesting, if puzzling. 


Writing for the majority, Justice Sopinka 
concluded that the “basket clause” 
authorization was lawful even though no 
mention was made of public pay phones 
nor were any limiting conditions 
imposed to protect the public. However, 
he wondered whether the interceptions 
which took place in this case pursuant 
to the valid authorizations were 
“reasonable” under section 8 of the 
Charter. 
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He concluded that in at least four 
instances, taps were placed on public 
pay phones solely because they were 
near where a suspect was staying and 
that this was insufficient evidence to act 
upon, “...(it) amounts to little more than 
indiscriminate monitoring based on a 
hunch” (p. 26). Furthermore, since this 
jeopardized the right to privacy of 
innocent third parties (hundreds of 
private conversations may have been 
intercepted when not one target was 
involved), Justice Sopinka concluded 
that it infringed upon section 8 of the 
Charter. 


Now the puzzling part. Justice Sopinka 
reasoned that it would not bring the 
administration of justice into disrepute to 
admit the evidence obtained from 
wiretapped public pay phones. 
Consequently, the appeal was 
dismissed and a new trial ordered. 


What comfort does this give us? Strong 
admonitions are made against relying 
on the “basket clauses” in wiretap 
authorizations. Judges and the police 
are strongly encouraged by the Court to 
minimize the intrusions upon the privacy 
of innocent third parties when seeking 
or granting wiretap authorizations and 
when intercepting communications. 

Yet, the law enforcement community is 
essentially told that if it fails to live up to 
these standards, no matter — their 
cases will not be jeopardized. 


The dissenting opinions of Justice La 
Forest and Justice Wilson point out the 
shortcomings in the thinking of the 
majority. Both said that since the 
tapping of public pay phones give rise, 
per se, to massive violations of privacy, 
judicial authorizations for such activity 
must be expressly made and not 
granted by implication under the “resort 
to” basket clause. By not taking this 
view, the Supreme Court has left it to 
Parliament to ensure that Charter 
infringements are not perpetrated by the 
police. How completely the respective 
roles of the Charter and Parliament 
have been turned. Justice La Forest 
puts it eloquently: 


"It will be obvious that the Act 
(Criminal Code) and the Charter 
place a heavy burden on the courts 
to ensure the privacy of Canadians. 
Electronic surveillance is 
indiscriminately acquisitive; its reach 
extends to the conversations of the 
innocent and the guilty alike. The 
indiscriminate acquisitiveness of 
electronic surveillance invites the 
courts to redouble their vigilance and 
to be especially sensitive of the 
potential of certain practices to 
undermine the expectation of 
Canadians that their private 
communications are inviolable. This 
legitimate and reasonable 
expectation of privacy will not long 
survive if the courts give their 
imprimatur to practices that allow 
the police to intercept private 
communications solely on the basis 
of their own reasonable belief that 
valuable evidence stands to be 
gained thereby. In my view, ‘resorted 
to’ clauses can easily result in the 
application of this low threshold and 
constitute the ‘fishing expeditions of 
considerable latitude’ decried by this 
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court in Hunter v. Southam, supra, at 
p. 167. It is sad to reflect that, even 
with the assistance of the Charter, 
the courts have failed to take the 
steps necessary to avoid this danger 
and that if Canadians are to receive 
adequate protection against the 
insidious threat to individual privacy 
posed by electronic surveillance, they 
must turn to Parliament to provide 
additional safeguards. There is biting 
irony in this. The Charter was 
designed to protect us from possible 
inroads on individual rights by 
Parliament”. (pp. 13-14) 


And so, a Privacy Commissioner, at 
best, has mixed emotions about the 
Thompson decision. We must applaud 
the Court’s new insistence that, when 
police intercept private communications, 
the privacy rights of innocent third 
parties must be protected. There is a 
strong message to judges and the 
police to be especially vigilant when 
wiretaps are installed at places 
frequented by the public. Although the 
Court does not make it a mandatory 
requirement, it Suggests that visual 
surveillance accompany the wiretap to 
ensure that only a suspect’s 
conversations are intercepted. 
Canadians should be comforted by the 
Supreme Court’s consciousness of 
privacy threats to innocent parties when 
police engage in wiretapping. 
Nevertheless, the Court also makes it 
clear that if Canadians are to be 
adequately protected against these 
abuses, Parliament must act to 
strengthen the wiretap provisions of the 
Criminal Code. 
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Therefore, the Privacy Commissioner 
urges the government to propose, and 
Parliament to enact, measures 
necessary to ensure adequate control of 
wiretapping practices. 


This year’s Supreme Court privacy 
story, however, does not end with a 
whimper. Its decision in the case of 
Santiago Wong v. The Queen 
(November 22, 1990) is a bang. 


The Wong case resulted from a Toronto 
police gambling investigation conducted 
during the summer of 1984. The 
security staff of a major downtown hotel 
told police they suspected that hotel 
premises were being used for illegal 
gambling. There was evidence of 
gambling in a recently vacated hotel 
room and the police learned that the 
person who had reserved the room, Mr. 
Wong, had also reserved it for later the 
Same month. 


The police installed a video camera in 
the room with the permission of the 
hotel management but without judicial 
authorization or warrant. Activities in 
the room were monitored on five 
separate occasions and resulted in 
charges being laid against Mr. Wong 
and ten others for keeping a common 
gaming house. 


The trial judge found that the video 
surveillance was an infringement of 
section 8 of the Charter and dismissed 
all charges. The Ontario Court of 
Appeal, however, noted that invitations 
had been widely circulated within the 
Chinese community and that strangers 
who came to the hotel room were 
welcomed. In these circumstances, the 
court found that the accused had no 
reasonable expectation of privacy and 
that, as a result, section 8 of the Charter 
did not apply. A new trial was ordered. 
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On appeal the Supreme Court, in a 6-1 
decision, took a different view. It 
concluded that without judicial 
authorization, such video surveillance 
was an infringement of the section 8 
protection against unreasonable search 
and seizure. This decision is especially 
remarkable because it extends the 
privacy right to a right to freedom from 
indiscriminate video surveillance by 
agents of the state. The Court 
concluded that this privacy right must be 
protected by an independent judiciary 
and that police cannot be left to decide 
when video surveillance may be 
employed. 


In his majority judgment, Justice La 
Forest is clear that all forms of 
electronic surveillance by agencies of 
the state, not judicially authorized, 
violate section 8 of the Charter. 


"the broad and general right to be 
secure from unreasonable search 
and seizure guaranteed by s. 8 is 
meant to keep pace with 
technological development, and, 
accordingly, to ensure that we are 
ever protected against unauthorized 
intrusions upon our privacy by agents 
of the state, whatever technical 
forms the means of invasion may 
take.” (p. 6) 


As aresult of Wong, it is no longer 
appropriate for a court to inquire into 
whether a person who is the subject of 
unauthorized surveillance has “courted 
the risk”. 


In Justice La Forest’s words: 


"privacy would be inadequately 
protected if an assessment of the 
reasonableness of a given 
expectation of privacy were made to 
rest on a consideration whether the 
person concerned had courted the 
risk of electronic surveillance. !n 
view of the advanced state of 
surveillance technology, this would 
be to adopt a meaningless standard, 
for, in the final analysis, the technical 
resources which agents of the state 
have at their disposal ensure that we 
now run the risk of having our words 
recorded virtually every time we 
speak to another human being.” 


(p. 7) 


Thus, despite the fact that the accused 
had widely issued invitations to his hotel 
room and opened the door to strangers, 
he did not lose his right to a reasonable 
expectation of privacy. The Court made 
it clear that while we might impose 
warrantless video surveillance on those 
who engage in illegal activities in their 
hotel rooms, society would object to 
imposing that risk on anyone who rents 
rooms. In order to avoid the latter, the 
Court considered that it must prohibit 
the former. 


Unlike wiretapping, there is currently no 
available procedure for police to obtain 
a judicial authorization for video 
surveillance. The Court was fully aware 
of the handicap its decision imposed 
upon the police, but felt that only 
Parliament should decide the 
circumstances in which the police could 
invade privacy by means of video 
surveillance. 
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In Justice La Forest’s words: 


"On my view of the matter the courts 
would be forgetting their role as 
guardians of our fundamental 
liberties if they were to usurp the role 
of Parliament and purport to give 
their sanction to video surveillance by 
adopting for that purpose a code of 
procedure dealing with an altogether 
different surveillance technology. It is 
for Parliament, and Parliament alone, 
to set out the conditions under which 
law enforcement agencies may 
employ video surveillance technology 
in their fight against crime. 

Moreover, the same holds true for 
any other technology which the 
progress of science places at the 
disposal of the state in the years to 
come.” (p. 22) 


No doubt the government will introduce 
legislation to provide for the judicial 
authorization of video surveillance by 
the police. That would be the 
responsible course since no one 
questions the need for video 
surveillance in law enforcement. 
However, as with wiretapping, the 
Privacy Commissioner urges Parliament 
to ensure that any process for obtaining 
judicial authorization for video 
surveillance protects the privacy of 
innocent parties. 


Cellular Phones and Privacy 


In the past year Canadians have 
become aware—some painfully so— 
that cellular telephone calls can be 
intercepted. 


One British Columbia cabinet minister 
resigned after a newspaper printed 
extracts from calls he made on his car 
phone. Some provincial delegations at 
the Meech Lake Conference suspected 
that their cellular communications had 
been intercepted. And a provincial 
power corporation was embarrassed 
when someone intercepted and 
published an employee’s comments 
about third parties during a cellular 
phone conversation. 


Faced with this troubling new threat to 
privacy, the Commissioner has tackled 
two questions: 


¢ Does the Privacy Act protect cellular 
phone calls? 


« And do federal government 
institutions, including its law 
enforcement agencies, only intercept 
cellular communications in 
compliance with the law? 


The Supreme Court decisions 
(discussed above) make it clear that, 
without proper judicial authorization, 
agencies of the state may not subject 
individuals to any form of electronic 
surveillance. To do so would be 
“improper search and seizure”. It would 
sacrifice our right to a reasonable 
expectation of privacy, thus infringing 
section 8 of the Charter of Rights and 
Freedoms. 


The state may no longer assume that 
individuals have waived their right to 
privacy just because they “court the risk” 
of surveillance by, for example, using a 
communications technology known to 
be vulnerable to interception. According 
to the Supreme Court, that assumption 
would incur a greater risk—that 
electronic surveillance without a proper 
warrant would so dilute our privacy as to 
be inconsistent with a free and open 
society. 


That conclusion has direct implications 
for the Privacy Act. The Act controls the 
collection of personal information by 
federal institutions. Principal among 
these controls is one which prohibits 
collecting personal information 
“'..unless it relates directly to an 
operating program or activity of the 
institution” (section 4). 


This provision is open to interpretation 
in specific cases. But it cannot be read 
to sanction a collection of personal 
information which would otherwise be 
unlawful. Collecting personal 
information in a way which violates the 
Charter would also breach the Privacy 
Act. 


Since the Privacy Act is implicated when 
federal investigative bodies intercept 
cellular calls, the Privacy Commissioner 
wants to satisfy himself that any federal 
interceptions comply with the Act. 
However, the emphasis is on fact- 
finding. There is no reason to believe 
that federal authorities are unlawfully 
invading the privacy of Canadians’ 
cellular phone calls. 


The commissioner is making inquiries 


and anticipates reporting the results in 
next year’s annual report. 
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More troubling is the absence of any 
legal control over private citizens 
intercepting cellular phone calls. As one 
commentator puts it: 


“While the average cellular telephone 
user may be prepared to contend 
with occasionally finding another 
conversation sharing his line, he may 
be concerned to discover that 
conversations can be deliberately 
monitored using something as simple 
as an old TV set capable of receiving 
cellular UHF frequency”.(Network 
Newsletter, Vol. 10, No. 24, July 30, 
1990, p.1) 


Using the Charter, the Supreme Court 
has cobbled together protections 
against cellular monitoring by agents of 
the state, but the Charter does not 
control individuals’ behaviour. And it is 
doubtful whether current Criminal Code 
provisions prohibiting the surreptitious 
interception of private communications 
apply to cellular phone calls. After all, a 
cellular communication is carried on 
radio waves and so may not be 
considered “private”. 


Some other jurisdictions—California, for 
example—have passed laws prohibiting 
both interception of cellular calls and’ the 
sale or purchase of cellular 
eavesdropping devices. An even 
broader law is before the U.S. Congress 
covering computer communications and 
radio communications (H.R.3378 and 
S.1667). That proposal would make it 
unlawful to eavesdrop on a car phone 
conversation or any other private radio 
communication. 
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Of course, laws in themselves cannot 
ensure that cellular conversations 
remain private. In fact, some argue that — 
such laws could lull cellular phone users — 
into a false sense of security and, 
hence, be counterproductive. The 
Commissioner does not agree. It is vital 
for Parliament to act quickly to protect 
the privacy of cellular phone users. The 
mere disappearance of the wires which 
once carried our communications must 
not end in the disappearance of our 
privacy. 


Privacy in the Private Sector 


In a highly computerized society 
information knows no boundaries. Yet 
Canada contents itself with an 
information policy which distinguishes 
between the government and the private 
sector. There is some legal protection 
against information abuses in the 
federal (and some provincial) public 
sectors. But there are no controls over 
the private sector. 


In Europe, the situation is markedly 
different. Most member countries of the 
European Community (EEC) have 
imposed data protection controls over 
both the public and private sectors. And 
Europeans are strengthening and 
harmonizing these controls as they plan 
for a unified Europe in 1992. 


These developments have significant 
implications for Canadian firms doing 
business in Europe—or which hope to. 
Without comparable data protection 
laws in Canada’s private sector, 
European countries may no longer allow 
companies to transfer their citizens’ 
information to Canada. In effect, 
European data protection laws could 
become a non-tariff barrier, seriously 
hampering Canadian firms in their 
dealings with what promises to be one 
of the strongest trading blocks in the 
world. 


This is no idle fear. In July 1990 the 
EEC issued a draft directive on 
protecting individuals’ personal data. If 
adopted, it would bind all EEC member 
countries on January 1, 1993. The 
directive is designed to accomplish two 
broad goals. 


- The first is to establish a uniform, 
high level of privacy protection in 
both the public and private sectors. 


¢ The second is to remove all barriers 
to the free flow of personal data 
among member countries. 


The directive has alarming implications 
for non-EEC member countries which 
do not measure up to the European 
standards. Article 24 of the draft 
requires members not to transfer 
personal data to any jurisdiction which 
does not ensure the data adequate 
protection. Given current Canadian law, 
it is unlikely that the private sector could 
prove that it adequately protects 
personal data. 


All relevant European authorities—the 
OECD, the Council of Europe, the EEC 
and European data protectors—are fully 
aware of the directives’s implications for 
countries which are not EEC members. 
They know that Canada (and the U.S., 
too) endorses data protection principles 
(Canada has signed the OECD 
Guidelines on the Protection of Personal 
Information). And they know that North 
America prefers to let the private sector 
police itself through voluntary 
compliance. But the Europeans also 
know that voluntary compliance has not 
proved particularly successful. In both 
Canada and the U.S. only a handful of 
private firms have established 
meaningful data protection codes of 
practice. 
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And so, while the Europeans have been 
willing to accept that there may be more 
than one way to ensure adequate data 
protection (voluntary codes among 
them), they are unwilling to compromise 
on the principle. There must be 
meaningful protection. European data 
protectors, the guardians of their 
citizens’ privacy, will no longer agree to 
risk it by authorizing transfers of 
personal data to countries that pay only 
lip-service to data protection. 


This is not a prediction hazarded on a 
whim. It is a Summation of the 
comments of several European data 
protectors to the Privacy Commissioner. 


In last year’s annual report, the Privacy 
Commissioner recommended that 
Parliament amend the Privacy Act to 
require federally-regulated private 
sector firms to develop, file and 
implement privacy codes based on the 
internationally accepted principles 
established in the OECD Guidelines. 


From his discussions with European 
data protectors the Commissioner 
believes voluntary codes would be 
acceptable—as long as they had this 
statutory underpinning. 


Therefore, the Commissioner considers 
action on this recommendation is 
urgent. Not only do Canadians deserve 
this much privacy protection but, without 
it, Canadian firms risk labouring under a 
significant competitive disadvantage in 
their post-1992 dealings with Europe. 


Hopeful beginnings 


Private sector success stories should 
not be treated lightly simply because 
they are few in number. A case in point: | 
in December 1990 the Canadian 
Bankers’ Association (CBA) approved a 
model privacy code containing the 
minimum data protection standards 
member banks must apply to their 
customers’ information. 


The code provides customers with rights 
of access to and correction of their 
information. As well, it controls the 
banks’ collection, retention, use, 
disclosure, disposal and security of 
customer records. Banks have an 
admirable success record in protecting 
customer confidentiality but now the 

code will give their customers greater 
control over their financial information. 


Privacy advocates (the Commissioner 
among them) will find flaws. One that 
stands out Is the code’s failure to 
provide customers with access rights to 
recorded opinions or judgements about 
them. Only factual information will be 
available. Nor will the code protect 
employees. Nevertheless, CBA’s 
adoption of a code must be applauded. 


Another success story is Bell Canada, 
the largest telecommunications public 
utility. It too has adopted a privacy 
code. However, the Bell code grants 
privacy rights’and protections to 
employees as well as customers. And 
access rights are not limited to factual 
data. 


In an increasingly competitive 
telecommunications environment, Bell’s 
tangible sensitivity to its customers’ and 
employees’ privacy is bound to have a 
ripple effect. The Commissioner urges 
other telecommunications companies to 
follow suit. He will monitor and report 
their progress. 


Finally, important new privacy 
protections were recently announced by 
the Canadian Direct Marketing 
Association (CDMA). On February 13, 
1991, CDMA launched its “Operation 
Integrity”. CDMA has strengthened the 
privacy protections in its code of ethics, 
committing itself to giving consumers 
greater control over unwanted intrusions 
by direct mailers and telemarketers. 


The program requires all CDMA 
members to allow consumers to opt out 
of their mail and phone lists. In addition, 
members must not include sensitive 
medical, financial, insurance or court 
information in the lists they rent. Finally, 
CDMA has established a task force of 
senior industry officials to study the 
privacy impications of direct marketing 
and to develop additional policies on 
transferring data. 


Operation Integrity is an important step 
towards ensuring consumers’ privacy is 
respected. The Privacy Commissioner 
appreciates CDMA’s courtesy in 
keeping him informed and looks forward 
to continuing this dialogue. 
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Biomedical Testing 


Drug testing 


Regular readers of these reports will 
recall last year’s strong cautions against 
resorting to widespread drug testing to 
wage the “war on drugs” in the federal 
government. 


The Commissioner’s in-depth study— 
Drug Testing and Privacy—examined 
several environments - transportation, 
prisons, the armed forces and athletics. 
Many testing programs being 
contemplated by the government risked 
violating the Privacy Act, the Charter of 
Rights or broader notions of the 
individual’s integrity. 


Clearly there has been some movement 
to protect privacy interests threatened 
by drug testing. The office has been 
consulted by Health and Welfare about 
drug testing protocols. It has responded 
to the federal government's report on 
drug testing in transportation. And it 
has discussed with the Correctional 
Service of Canada (CSC) its proposed 
regulations on drug testing in federal 
penitentiaries. 


Transport Canada no longer proposes 
to conduct random mandatory drug 
testing for those in safety-sensitive 
positions. CSC’s proposed regulations 
are an improvement over earlier ones 
struck down in 1989 by the trial division 
of Federal Court in the Jackson case. 
Health and Welfare testing protocols 
now contain less intrusive means of 
taking urine samples than did earlier 
proposals. 
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Unfortunately there are elements of the | 
transportation drug testing policy that | 
remain troubling. Transport Canada still | 
intends to impose urinalysis at the time | 
of employment, transfer and during 
regular medicals although its own 
research revealed no serious threat to 
Safety in the industry caused by 
substance use. As well, urinalysis | 
provides very limited information—that a | 
substance has been consumed in the 
past—but not how often or whether the 
employee was impaired or, more 
important, is now impaired. Mandatory 
drug testing in these circumstances 
offends the Privacy Act and might not 
survive a challenge based on the 

Charter of Rights and Freedoms. 
Urinalysis should be confined to testing 
“for cause” or after an accident. 


Regrettably, National Defence remains 
committed to its proposal to impose 
drug tests on its members.This, despite 
the Commissioner’s recommendations 
and the transport committee’s 
conclusions about random mandatory 
testing. DND intends to test for cause, 
as part of an accident or incident 
investigation, during a probation period 
following a positive test result and for 
data collection. It also plans random 
mandatory tests of members in 
operational or safety-sensitive positions. 
Unfortunately, although DND has not yet — 
begun testing, it remains committed to | 
the program or a modified version of it. 


_ There is yet another concern. Fitness 
and Amateur Sport responded to the 

_ Dubin report on drug use among 

_ amateur athletes by setting up a new 
anti-doping organization funded 


primarily by—but not part of—the 


_ federal government. The organization 


will co-ordinate all sport anti-doping 


_ programs in Canada and conduct an 
~ expanded program of testing athletes 
_ for banned substances. 


_ A major focus of the program would be 
_ “no-notice” testing of athletes outside of 


- competition. Up to 3,000 tests could be 
- conducted (presumably annually), the 


majority of which would be no-notice. 


Because the anti-doping organization 
will not be a federal agency, It will not be 
subject to the Privacy Act. This may 
have been a deliberate attempt to 
circumvent the Act. Nevertheless, the 
organization’s approach (as announced 
by the minister) prompts some general 
privacy objections. Athletes may find 


themselves with precious few privacy 


rights. The Commissioner intends to 
discuss this situation with officials from 
Fitness and Amateur Sport. 


The Commissioner continues to be 
concerned about the lack of merit of 
most drug testing programs. Little this 
office has seen in the past year has 
altered its thinking about the 
fundamental futility of testing programs 
and their inherent intrusiveness. The 
government's example is a poor one for 
the private sector to follow. In most 
cases, the programs now contemplated 
or introduced by government appear not 
to comply with the Privacy Act. But 
public criticism of these programs is the 
strongest weapon this office has. It 
cannot enforce compliance. 


HIV testing 


The office’s principal work on HIV/AIDS 
was the 1989 report, AIDS and the 
Privacy Act. The office also 
contributed to developing the 
“Guidelines on Ethical and Legal 
Considerations in Anonymous Unlinked 
HIV Seroprevalence Research”. The 
guidelines were developed through 
meetings arranged by the Federal 
Centre for AIDS in late 1988 and 
published in the Canadian Medical 
Journal in 1990. In February 1991 the 
office participated in a review of the 
Original guidelines. 


In November 1990 the Commissioner’s 
office was represented at the meeting of 
the Council of International 
Organizations of the Medical Sciences 
(CIOMS), a World Health Organization 
body. The meeting discussed draft 
ethical guidelines on epidemiological 
research, including HIV/AIDS research. 
Staff continue to handle requests and 
investigate complaints about privacy 
and HIV/AIDS. Since the requests often 
concern issues or bodies not covered by 
the Privacy Act, the office attempts to 
re-direct callers to the appropriate 
authorities. 


The office’s work on HIV/AIDS is 
complemented by work in Ontario. The 
Ontario Law Reform Commission is 
doing a broad study on the legal (and, to 
some extent, ethical) implications of 
HIV/AIDS testing. The Ontario 
Information/Privacy Commissioner has 
published two reports on HIV/AIDS, one 
dealing with HIV/AIDS and privacy, the 
other with HIV/AIDS and the workplace. 
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Genetic testing 


Genetic testing is just one of many 
evolving biotechnologies that pose 
serious privacy dilemmas. Genetic 
testing encompasses three techniques. 
The first—genetic screening—examines 
a tissue or blood sample from an 


individual for genes or genetic “markers” 


indicating a present or potential genetic 
disorder or other physical trait. 


The second technique is genetic 
monitoring. It looks for genetic or 
chromosomal changes that may be 
caused by exposure to workplace or 
environmental chemicals or phenomena 
(radiation or the fumes from plastics, for 
example). 


The third technique is forensic DNA 
analysis, sometimes colloquially (and 
inaccurately) referred to as DNA 
fingerprinting. This technique matches 
samples of material genetically. Blood 
Stains from the scene of a crime may be 
genetically matched with those of a 
suspect. Forensic DNA analysis may 
also prove blood relationships in 
immigration or paternity cases. 


Genetic technology holds great promise 
for the identification of genetic 
disorders, a limited number of which 
may be treatable. However, there is a 
privacy concern in the potential of 
genetic testing to reveal highly sensitive 
information about the person tested and 
his or her genetic relatives. 


20 


Other forms of biotechnological testing, 
such as screening for HIV/AIDS 
antibodies or drugs, reveal only a single 
piece of information—infection with the 
HIV or the past use of drugs. But 
genetic testing can reveal hundreds of 
bits of information about an individual or 
relative. The data ranges from the 
certainty of developing crippling or 
deadly diseases (such as Huntington’s 
chorea or cystic fibrosis), to the 
likelihood of developing psychiatric — 
disorders (manic depression) to 
predispositions to elevated cholesterol 
levels, high blood pressure or certain 
cancers. 


Genetic testing is on the brink of 
becoming an issue in human 
reproduction (pre-conception, prenatal 
and neonatal testing), employment 
(Screening and monitoring), access to 
government and private sector services 
(schooling, insurance, credit), criminal 
investigations, during ordinary medical 
care and in performing research. 


The current and potential uses of the 
information produced by genetic testing 
persuaded the Commissioner to study 
its privacy implications. While its uses 
are now confined primarily to 
reproduction, its potential is enormous. 
Better that society examine the 
technology’s implications before it 
attacks privacy rights. The study should 
be completed by late Spring 1991. 


The Commissioner has always been 
loathe to press for regulation of the 
private sector. However, the privacy 
implications of genetic testing demand 
that the government consider whether 
there should be direct regulation of any 
private sector uses of this highly 
intrusive technology. 


The Commissioner is not alone. Privacy 
experts are examining similar measures 
in the United States. Most western 
European countries already regulate 
personal data collection by the private 
sector. In this sense, Canada is falling 
behind a growing movement to protect 
individual privacy not only from 
governments, but from the seemingly 
insatiable curiosity of the private sector. 
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Electoral Reform - A Permanent Voters’ List | 


Privacy issues can rear their heads 
where least expected. A case in point 
was the government’s appointment of a 
Royal Commission to determine 
whether Canada’s electoral laws 
needed overhauling. 


The commission was asked to examine 
the electoral process and party and 
campaign financing and to study the 
option of a permanent voters’ list that 
would replace door-to-door 
enumeration. 


Doing away with costly, time consuming 
door-to-door enumeration may be 
appealing. The process contributes to 
the length and expense of Canadian 
federal elections, but the alternative 
needs serious study. 


The commission heard proposals which 
focussed on combining data from such 
federal data banks as income tax files, 
citizenship information, change-of- 
address notices to Canada Post, census 
forms and pension records. Others 
proposals suggested Incorporating 
provincial health and drivers’ records 
and there was significant support for a 
voter’s identity card or a requirement 
that voters produce a Social Insurance 
Number. 


As a result, the Privacy Commissioner 
wrote to the commission asking it to 
consider the privacy impact of its 
recommendations. 
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His concerns included the implication of 
new large-scale collections (or linkages) | 
of personal information. This type of 
permanent voters’ list would become the. 
sort of population register that could 
pose a real threat to human rights and 
freedom. Wartime experience proves 
that such lists will be abused—even in 
Canada—to subject large groups of 
individuals to discriminatory treatment, 
arrest, detention and confiscation of 

their property. 


Further, once in place, pressures would 
mount to make the list widely available 
to all arms of government for unrelated 
uses. Ensuring exclusive election use 
and absolute confidentiality of the data 
would be vital. 


Growing dissatisfaction with abuses of 
SIN reflects public resistance to national 
identification and registration 
schemes—a resistance which would be 
compounded if SINs were used to link 
the databases and to establish a 
citizen’s right to vote. 


Finally, the Privacy Act prohibits access 
to other federal data bases to create 
such a list. Thus, Parliament would 
have to pass legislation to override the 
Privacy Act, a step the Commissioner 
could never support. 


Citizens around the world are fed up 
with being counted, recorded and 
monitored by the state. A voters’ list 
could evoke deep unease. It would be 
ironic if the electoral process—the heart 
of the democratic way of life—became 
the vehicle which tipped the scales 
further from the individual to the state. 


While the Commissioner does not want 

to restrict progress, he does want to ask 

some pertinent questions before the 

project advances too far. The electoral 

commission has welcomed his input and 

plans to report to the public in the fall of 
7091. 
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Privacy and the Public Interest: a Difficult Balance 


Generally the Privacy Act prohibits 
government institutions from disclosing 
personal information without the 
subject’s consent. However, the Act 
also recognizes 13 circumstances which 
dispense with this rule. 


One of the 13 is very general and, 
hence, both difficult to apply and easy to 
abuse. Sub-paragraph 8(2)(m)(\) 
authorizes disclosure without consent: 
“for any purpose where, in the 
opinion of the head of the institution, 
(i) the public interest in disclosure 
clearly outweighs any invasion of 
privacy that could result from the 
disclosure...” 


During the past year the most frequent 
user of this provision was Correctional 
Service of Canada (CSC). The situation 
develops when prison incidents such as 
escapes, unnatural deaths or hostage 
takings lead to internal investigations 
and subsequent reports. These reports 
contain personal information about both 
the inmates and prison officials who 
were involved. Consequently, CSC must 
consider the restrictions contained in the 
Privacy Act before disclosing the 
reports. 


CSC may want to release the reports in 
order to preserve public confidence in 
the correctional system. It may also 
need to provide copies to journalists 
who have requested access under the 
Access to Information Act or to 
members of Parliament or 
Parliamentary committees wanting to 
review the reports to assess overall 
correctional administration. In these 
situations, CSC removes information 
which is exempt under the Access to 
Information Act as well as sensitive or 
extraneous personal details. 
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CSC seeks to disclose only sufficient 
personal information necessary to 
satisfy the public interest test set out in 
the Privacy Act and give the public a 
clear picture of what transpired. 


Once this screening satisfies the 
commissioner of corrections and the 
solicitor general, they notify the Privacy 
Commissioner of the intended release, 
in advance if reasonably possible. 
When the Commissioner receives the 
notification, he assesses whether there 
is a public interest disclosure which 
clearly outweighs any resulting invasion 
of privacy. If he does not agree he tells 
the institution. However, the 
Commissioner has no power to prevent 
the release—only to tell the individuals 
affected that their information will be 
disclosed. 


Evidence of just how difficult it is to 
apply the “public interest” test was 
demonstrated in two disclosures which 
the Commissioner reported last year 
(“Reports on two inmate escapes”). The 
Standing Committee on Justice and the 
Solicitor General wanted to inquire into 
the events surrounding the two widely- 
publicized prison incidents—the escape 
from Dorchester, New Brunswick, of 
Allan Legere (during which he allegedly 
murdered one person) and the day-pass 
release from the Edmonton institution of 
Daniel Gingras (during which he 
murdered two people). 


CSC had previously disclosed censored 
versions of the investigation reports to 
the media and gave that version to the 
justice committee. The committee, 
however, wanted the uncensored 
versions and issued an order to the 
solicitor general for the complete 
reports. 


The solicitor general refused to act on 
the order, maintaining that the Privacy 
Act prohibited the disclosure. His 
refusal became the subject of a 
question of privilege in the House of 
Commons and the matter was referred 
to the Standing Committee on Privileges 
and Elections. 


In his testimony before the committee, 
the solicitor general held that he was 
responsible for respecting sub- 
‘paragraph 8(2)(m)(i) of the Privacy Act. 
Therefore he had to be satisfied that a 
‘public disclosure of the reports would be 
in the public interest and that this 
interest clearly outweighed any invasion 
of individual privacy. He did not believe 
that the Privacy Act gave him the 
authority to accede to the committee’s 
demand for an in-camera review of the 
uncensored reports. 


The then-acting Privacy Commissioner, 
appearing before the privileges 
committee, applauded the solicitor 
general’s resolve to protect the privacy 
of persons mentioned in the reports. 
However, he felt that the minister was 
taking an unnecessarily narrow view. 
Sub-paragraph 8(2)(m)(i) of the Privacy 
Act clearly gives the solicitor general the 
authority to determine whether 
disclosure of the uncensored reports to 
an in-camera session of the Justice 
Committee is in the public interest. The 
acting Commissioner maintained that it 
was not at all inconsistent with the 
provision to decide that disclosure to the 
committee is in the public interest, 
providing it takes place under conditions 
which would ensure that the censored 
portions remain confidential. 


At the time of this report, the final 
chapter of this story has yet to be 
written. The privileges committee has 
not concluded its deliberations and the 
Privacy Commissioner has not 
completed his investigation of a related 
complaint. 


"The truth, the whole truth and 
nothing but the truth” 


However, there is another facet to this 
story. It is unusual for the Privacy 
Commissioner to publicly remind 
government institutions that privacy is 
not an absolute value. But the Act does 
recognize that privacy may be invaded 
in order to serve certain important, 
collective goods. 


Being doctrinaire in insisting on 
confidentiality in all cases risks giving 
the Privacy Act a bad name—one it 
does not deserve. These CSC incident 
reports are a case in point. 


Although the public interest CSC wants 
to serve (by disclosing these reports) is 
public confidence in the corrections 
system, CSC has removed portions 
which are critical of correctionai staff 
members. While CSC’s action to shield 
these individuals may be 
understandable, it leads to a report 
which gives the public a less than 
complete picture of the incident. 


Without giving the “bad” with the “good” 
can CSC really be serving the public 
“interest”? This question is the subject 
of ongoing discussion between CSC 
and the Privacy Commissioner. What is 
needed, it would seem, is for CSC to 
use the public interest clause as an 
extraordinary measure and, when it is 
invoked, to ensure that the disclosures 
give the complete picture. 


Complaints Directorate 


Complaints have increased by 
approximately 10 per cent per year 
since the office opened for business 
seven years ago. This year the pattern 
continued as the office received 1,239 
complaints compared to 1,086 last 
year—a 14 per cent increase. 


Time limit complaints 


Occasionally the Commissioner felt like 
a stuck record during previous reports 
as comments about Correctional 
Service Canada and National Defence 
delays were a recurring theme. 


Now, the music has changed. Time 
limit complaints were down substantially 
this year and full credit goes to 
Correctional Service Canada. CSC’s 
response to the Commissioner's 
criticism of last year’s performance was 
a complete overhaul of its request 
handling procedures. 


The result was an astounding 200 per 
cent decrease in new CSC time limit 
complaints—from 214 last year to 50 
this year. Last year’s volume accounted 
for 50 per cent of the office’s delay 
complaints. This year’s total—only 15 
per cent. A tip of the hat to Correctional 
Service for a job well done. 
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Another entrenched cause of delay 
complaints was the Department of 
National Defence handling of members’ 
Personal Evaluation Reports (PERs). 
The problem occurred because military 
personnel had to make formal 
application to see their evaluations and 
the result was a huge caseload and an 
inevitable backlog. Last year the 
Commissioner applauded National 
Defence’s decision to treat PERs 
requests informally. As predicted, the 
number of privacy requests to DND 
dropped 20 per cent — most of the 
decrease directly attributable to the 
policy change. The result is a 36 per 
cent decline in time limit complaints 
against National Defence—from 78 to 
50! 


Clearly, government institutions are 
trying hard to respect the statutory time 
limits, the trend is evidence of that. But 
shrinking resources threaten the “good 
news’ story. An individual’s right to 
timely access to personal information 
should not be sacrificed on the altar of 
fiscal restraint. 


Fair information code 


Although complaints about denial of 
access were up, this past year’s 14 per 
cent hike results from a substantial jump 
in complaints about collection, use and 
disclosure of personal data—the fair 
information code. This year’s 
complaints against the code 
skyrocketed to an unprecedented 386 
from last year’s total of 173. 


Again, labour-management disputes at 
Canada Post Corporation seem to be at 
the root of the problem. The corporation 
appears to be administering its new 
leave management policy aggressively. 
Employees are concerned that medical 
information about them has been 
improperly collected and used to 
manage attendance at work. 


Top ten 


This year’s report includes a list of the 
office’s top ten clients, a group which 
accounts for 80 per cent of its total 
caseload. Correctional Service Canada, 
the perennial leader in the new 
complaints category until this year, has 
happily ceded that honour to Canada 
Post Corporation. 


DEPARTMENT = sds 


Canada Post Corporation 


Transport Canada 
National Archives of Canada 


Royal Canadian Mounted Police 


New complaints against Canada Post 
went from 97 to 237, while CSC’s 165 
are less than half of last year’s record 
392. 


Another significant increase occurred at 
Employment and Immigration Canada 
where the 128 complaints represented a 
three-fold jump. Transport Canada has 
returned to a more characteristic total of 
67 after a low of six complaints in 1989- 
90. For no apparent reason National 
Archives, National Defence and the 
Canadian Security Intelligence Service 
have also seen significant increases 
while Health and Welfare and the 
RCMP have experienced decreases. 
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How institutions measured up 


A number of factors—such as an 
unexpected volume of requests—can 
prompt complaints. Actually, many of 
the factors are beyond the control of the 
institutions. A more meaningful 
performance indicator is the proportion 
of complaints that are well-founded. 


Using this measure, the Royal Canadian 
Mounted Police is the most successful 
institution by a long shot. Only five 
complaints were well-founded (or well- 
founded/resolved) while 16 were not 
well-founded and seven were 
discontinued. This is a decrease from 
19 well-founded complaints two years 
ago and 10 last year. This reflects the 


RCMP’s sincere respect for the letter 
and spirit of the Act. But special kudos 
are due the RCMP’s access and privacy 
coordinator for his personal commitment 
to reducing the number of well-founded 
complaints. 


And National Archives continues to 
maintain its high standards—only four of 
23 complaints were well-founded, three 
of which were resolved. 


At the risk of appearing inconsistent, 
there is praise for Canada Post. 
Despite having the questionable honour 
of first place as the office’s most 
important client, only 50 of the 230 
complaints were well-founded. Of 
these, 37 were resolved. 
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Although CSC seems to have 
conquered its delay problems, it had the 
worst ratio of justified complaints among 
the large institutions as 64 per cent— 
103 of 162—of the complaints 
investigated were considered well- 
founded. Not far behind were 
Employment and Immigration and 
Revenue Canada Taxation with 60 per 
cent and National Defence with 58 per 
cent well-founded. 


Overall, investigators completed 1,008 
investigations comprising 551 not well- 
founded, 402 well-founded and 55 

discontinued. 


This year the complaints have been 
grouped under three major headings. 
They are: access complaints—dealing 
with individuals’ problems with their 
applications to see personal records; 
privacy complaints—concerning the fair 
information code (proper collection, use 
and disclosure); and time limits— 
including both delay in the initial 
response to an application or time 
extensions. 


More resources please! 


Despite having completed more than 
1,000 cases, the norm for the past three 
years, 589 complaints were pending at 
the end of the year—a 38 per cent 
increase from the preceding year. 
Sadly, this means a return to the 
backlog the office worked so hard to 
eradicate two years ago. The problem 
will be compounded if the 10 per cent 
increase forecast for 1991-92 
materializes—and it probably will if this 
year’s 14 per cent increase is an 
indicator. 


Unless the office receives more staff 
and money, its open caseload will soar 
to more than 700 complaints by the end 
of the current year. This represents 
more than the total caseload 
investigated by the office in the 1987-88 
year. 


Despite increased productivity, the 
office has not closed more cases this 
year. Increased efficiency has been 
more than offset by the drop in time limit 
complaints (which consume fewer 
resources) and the rising tide of 
complaints against the fair information 
code (the most complex and time- 
consuming investigations). 


Unfortunately the government turned 
down the office’s request for more 
investigators and operating funds. This 
decision will exacerbate the ever- 
increasing backlog; increase 
investigator's caseloads and keep 
clients waiting longer for decisions on 
their complaints. In short, the office now 
risks becoming part of the problem. 
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Complaints Completed by Grounds 1990-91 


Access 40.72% 


Correction/Notation 1.76% 


Time Limits 36.04% 


Index 0.10% 
Use & Disclosure 16.31% 


Collection 3.52% 


Retention & Disposal 1.56% 


Completed Complaints 1983-91 


1400 


ao 
N 
o 
< 
QD 
se] 
=] 


y 
Jae 


1000 


- 
oO 
~ 


800 


a 


S 
D 
a| 


N 
& 
N 


So 
So 
N 


600 
400 
200 


84-85 85-86 **86-87 87-88 88-89 89-90 90-91 


*83-84 


**Revised counting method 


oH 


Completed Complaints by Department and Result 


Results 
Department Total Nees Metis a ee Disco 

Agriculture Canada 11 2 1 8 
Canada Post Corporation 233 13 39 171 
Canadian Human Rights Commission 5 1 3 1 
Canadian Security Intelligence Service 83 6 9 Do 
Commissioner of Official Languages 1 0 0 1 
Consumer and Corporate Affairs Canada 5 3 0 1 
Correctional Service Canada 162 84 19 49 
Employment and Immigration Canada 78 33 10 27 
Environment Canada 1 0 0 1 
External Affairs Canada q 3 0 3 
Farm Credit Corporation Canada 1 0 0 1 
Finance Canada 1 0 0 1 
Fisheries and Oceans 6 1 3 1 
Health and Welfare Canada 34 16 3 VS 
Indian and Northern Affairs Canada 0 0 10 
Justice Canada 9 0 
Labour Canada 1 0 
National Archives of Canada 24 1 3 19 
National Defence 84 34 8 31 
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Results 

Departm ent _ | _ Total Well-founded / ies 7 bck Discontinued 
ional Museums of Canada 1 0 0 1 0 
nal Parole Board -  —rr— 2 5 oe 0 
'y Council Office 6 2 0 1 0) 
ervice Commission of Canada 2. 0 0 0 
‘lic Service Staff Relations Board 7 0 3 0 
e Canada, Customs and Excise i 1 0 
renue Canada, Taxation % “Al 43 0 28 0 
| Canadian Mint — | 7 so tC LLU 
yal Canadian Mounted Police | 78 2 3 66 r 
P Public Complaints Commission _ 0 0 { 0 
sretary of State of Canada 3 2 0 1 0 
tor General Canada 44 1 0 12 1 
Lawrence Seaway 1 0 0 1 0 
1 0 0 0 
3 0 2 1 0 
42 27 2 12 1 

1 0 0 0 
5 3 0 z 0 
1,024 292 115 562 ste 
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Origin of Completed Complaints 


Newfoundland 


Northwest Territories 


Outside Canada 


; 
j 
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Cases 


Tax files not for fan mail 


_ Ajournalist got a fan letter from a 
| federal employee at her home address 

_ and called the Commissioner's office to 
inquire how the admirer could have 

_ found her private residence. The 
journalist did not want to lodge a 
complaint or get the employee into 
trouble, but she was concerned both for 
| her safety and how the information had 
_ been obtained. 


| The office was torn between respecting 
_ her wishes and ensuring that federal 

| employees not use government files for 
| purposes well outside the most 

| generous interpretation of a “consistent 
use”. The investigator tracked the 

| source to Revenue Canada-Taxation. 

: 


Confronted with his letter, the employee 
explained that he simply wanted the 
| woman’s autograph. He did not appear 
to pose any threat to the journalist, who 
_ was relieved and asked that the case be 
| discontinued. 
d 
| However, the revelation that the 
/ employee used information from 
' Taxation data obliged the office to tell 
| Revenue Canada which has a strict 
_ code of ethics and imposes stringent 
_ security measures on handling 
_ taxpayers’ files. Taxation investigated, 
found this was not the only incident and 
disciplined the employee. 
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Revenue Canada delays 


Even though the Privacy Act has been 
in effect for eight years, failure to meet 
time limits continues to be a problem. 


To name just one, Revenue Canada- 
Taxation occasionally displays an 
indifference to applicants’ rights to 
receive their information within the time 
the law allows. Curious since Taxation 
promptly penalizes taxpayers who are 
casual with tax filing deadlines! 


For example, on May 7, 1990, a woman 
went to the Vancouver taxation office to 
inquire about an application she had 
filed in January to see her income tax 
file. Taxation had no record of the 
request so she made another. On June 
26, she called the Commissioner's office 
to complain that she had neither heard 
nor seen anything. 


The office called Taxation to inquire. 
Even so, the woman did not receive the 
file until August 13, 96 days later. 
Departments are allowed to ask for a 
30-day extension under some 
circumstances. However, they must 
notify the applicant who then may 
complain if she considers the extension 
unreasonable. 


Revenue Canada had no justification for 
not writing to the woman to 
acknowledge her request, to say when it 
would provide the file and—ultimately— 
for not responding in time. 


The Commissioner considered the 
complaint well-founded. 
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Court orders CSIS to respond 


The Canadian Security Intelligence 
Service (CSIS) told an applicant that it 
could not provide the personal 
information he wanted in the 30 days 
the Act allows. 


The delay was partly the result of many 
new applications (apparently prompted 
by an article in the Toronto Star) and 
by the need to consult other parties 
before it could release the material. 


The man complained to the 
Commissioner and told the investigator 
that he intended to go to Federal Court 
if CSIS did not give him the information 
within the maximum 60 days set out in 
the Act. 


On the 61st day, when the 
Commissioner found CSIS had still not 
finished processing the man’s records, 
he concluded the complaint was well- 
founded and advised the complainant of 
his right to go to Federal Court. 
(Applicants may not ask for a court 
review until the Commissioner has 
completed his investigation.) 


The complainant asked the court to 
issue a Writ of Mandamus which would 
compel CSIS to produce the 
information. The motion was heard 20 
days later and the judge ordered CSIS 
to reply to the man’s request within one 
month of the date of the order. CSIS 
complied. 
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Although CSIS finally provided the 
information, the hearing (and the extra 
month the court allowed) added yet 
another 50 days to the process — 
hardly a satisfactory solution. After 
eight years of living with the Privacy Act, 
it is unacceptable for applicants to have 
to go to court to force departments to 
provide timely access. 


More access during military 
grievances 


A complaint against National Defence 
(DND) may have prompted it to change 
its grievance procedures for military 
members. The case raised important 
questions about a member’s access to 
factual information collected by DND’s 
legal services during the grievance 
process. 


At DND, lawyers may investigate 
military grievances to prepare legal 
opinions and advise the chief of defence 
staff. Normally, government staff 
relations officers (who are not lawyers) 
investigate such grievances. The 
military procedure effectively extends 
legal privilege over more of the 
documents. 


The problem this causes became 
apparent when an officer complained to 
the Commissioner that DND had denied 
him a good deal of information from his 
grievance file, claiming exemptions for 
solicitor-client privilege or personal 
information about other individuals. 
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The investigator confirmed DND used 


the solicitor-client exemption on all the 
documents either obtained or prepared 
by its legal services during the 
grievance investigation. The 


department argued that the material 
became privileged since its legal 


services developed the file specifically 


to prepare a legal opinion and 


recommendations for senior staff. 


The Commissioner was concerned 
about such a broad use of the solicitor - 
client privilege, considering it both unfair 
and contrary to the spirit of the act to 
use the privilege to withhold factual 
material and witness statements 
obtained during the investigation. He 


suggested DND use its discretion to 
disclose more information to the 
complainant. DND agreed to reconsider 
and gave the officer ten more pages of 


information including the witnesses’ 


- statements. 


The Commissioner also agreed that the 


other disputed material was personal 
information about other individuals and 


that it was correctly exempted. 


-DND has since revised its military 


grievance procedures and now 


- discloses to members all documents 


(with some limited exceptions) which the 
adjudicative authority will review when 
considering their grievances. 


Can’t claim exemption if doctor to 
disclose 


A man complained to the Commissioner 
when National Archives denied him 
portions of his old military medical 
records, considering it to be not in his 
“best interest” (Section 28) to examine a 
25-year-old mental health assessment. 
National Archives was prepared, with 
his written consent, to give the 
information to his family doctor who 
could then explain the assessment. 


Privacy regulations allow a department 
to require an applicant to examine 
personal health records only in the 
presence of a qualified medical 
practitioner or psychologist who can 
explain the information. 


In this case, however, the man argued 
that he knew the contents of the 
assessment and did not need an 
explanation. 


The Commissioner held that if Archives 
thought it was not in the applicant’s best 
interest to see the records it should 
exempt them entirely. But if it intended 
to disclose the m—even through his 
doctor—then it was inconsistent to claim 
it was not in his best interest. 


The Commissioner was also concerned 
that Archives refused access based on 
a review by a psychiatrist retained to 
assess the file when the man submitted 
similar privacy requests in 1985 and 
1990. The Commissioner considered 
the assessment unreliable since it was 
based solely on a review of medical files 
dating back 25 years and did not 
consider the man’s current emotional 
State. 
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The information was disclosed after the 
Commissioner concluded that the man 
was entitled to see the file. Further, 
National Archives agreed to change its 
procedures for processing sensitive 
medical information. In future, it will 
either claim the medical exemption or 
disclose the information directly to the 
applicant or to his or her doctor. 


Witness statements available after 
investigation 


A woman who had lodged a 
discrimination complaint with the 
Canadian Human Rights Commission 
(CHRC) asked to see the information in 
the CHRC complaint file. She 
complained to the Privacy 
Commissioner when CHRC withheld 
some of the data. 


What CHRC had refused to disclose 
was addresses and telephone numbers 
of other individuals and witness 
statements. The Commissioner agreed 
that others’ personal information was 
legitimately exempt. However, he 
disagreed with exempting the witness 
statements once the investigation was 
completed. 


Generally, the Privacy Commissioner 
agrees that witness statements should 
not be disclosed during investigations 
because this might harm the 
investigation. However, in the case at 
issue, the investigation was complete. 
The Commissioner asked CHRC to 
demonstrate what injury could 
reasonably be expected if the 
complainant saw the witness 
statements. 
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CHRC was unable to demonstrate any 
reasonable possibility that disclosure 
would injure either this or future 
investigations. Nonetheless, it took 
considerable persuasion before CHRC 
finally agreed to disclose the statements 
to the complainant. Since the 
information was initially denied, the 
Commissioner considered the complaint 
well-founded but resolved. 


Revenue Canada can see personal 
expenses 


An Ontario woman’s difficulties paying 
her federal income tax arrears 
generated a complaint against Revenue 
Canada - Taxation. The woman was 
upset when an officer insisted on 
examining her personal expenses to 
assess her ability to pay. He 
maintained that the Income Tax Act 
gave him that right but the woman felt 
the procedure was abusive and an 
invasion of her privacy. 


The Privacy Act limits government 
institutions’ collection of personal 
information to that which “relates directly 
to an operating program or activity of 
the institution”. This effectively restricts 
government collection to personal 
information which clearly is required for 
that program. 


Revenue Canada explained that as 
administrators of the Income Tax Act, it 
is responsible for collecting individuals’ 
income tax. The department has a 
collection procedure that ensures that 
the law is applied equitably to all 
taxpayers, but yet allows it to consider 
each individual’s financial 
circumstances. In fairness to the 
majority who pay promptly, the 
department’s policy deals firmly with 
those who do not. 
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The Commissioner reviewed Taxation’s 
collection policy and agreed with the 
collection officer's need to examine the 
taxpayer’s personal expenses. Under 
the circumstances the Income Tax Act 
requires her to provide this type of 
information. Thus, the Commissioner 
considered Taxation had respected the 
collection provisions of the Privacy Act 
and he concluded that the complaint 
was not well-founded. 


Hiring must balance fairness and 
privacy 


A complaint against Employment and 
Immigration Canada (EIC) 
demonstrated the difficulty of making 
the hiring process transparent without 
stripping away candidates’ privacy. 


Two successful candidates in an 
internal EIC competition complained 
that a staffing officer gave their personal 
evaluations and personal references to 
another employee who was appealing 
the results. This person then circulated 
the information in the office. 


The Public Service Commission’s policy 
on appeals requires departments to 
disclose only directly relevant personal 
information about the successful 
candidates. In this case the evaluations 
had been used during the staffing 
process but were neither referred to 
during the appeal nor considered as 
part of the appeal decision. Clearly they 
were not relevant. The disclosure was a 
significant invasion of the employees’ 
privacy although the result of a perhaps 
overzealous attempt to be fair. 


EIC reminded all its personnel divisions 
about the disclosure policy and will 
issue more detailed guidelines for 
staffing officers caught between the 
competing demands of fairness in 
Staffing and protection of candidates’ 
privacy. 


Immigration disclosure of refugee 
claim “consistent” 


A man wrote to the Commissioner 
objecting to an immigration officer 
having told officials of a U.S. state 
(without his consent) that he was 

claiming refugee status in Canada. 


During his refugee hearing, it became 
apparent that the man had been found 
guilty of a criminal offence in a state but 
he had failed to appear for sentencing. 


The complainant argued that since the 
process was not complete, his situation 
was not equivalent to a criminal 
conviction in Canada which would 
prevent him being considered a refugee. 
A senior immigration officer wrote to the 
clerk of the state’s first circuit court to 
determine whether the man was 
considered to have been convicted. 
The letter explained that Immigration 
needed the information because the 
complainant had applied for refugee 
status. 


The state court confirmed that the 
judicial finding of guilt was a conviction. 
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The investigator found that one of the 
objectives of the /mmigration Act is “to 
promote international order and justice 
by denying the use of Canadian territory 
to persons who are likely to engage in 
criminal activity”. The Commissioner 
concluded that revealing the man’s 
refugee claim was permissible because 
it was consistent with Immigration’s 
purpose for having obtained the 
information. He considered the 
complaint not well-founded. 


Direct pay request premature 


A Transport Canada employee 
complained that the department was 
asking for his bank account number so it 
could deposit his pay directly, rather 
than issue a cheque. 


Transport’s request apparently followed 
the federal government’s announcement 
that it would stop paying employees by 
cheque on April 1, 1991 and begin 
depositing pay directly into employees’ 
bank accounts. 


The complainant objected strongly to 
having to give his bank account number 
to his employer. In fact, he was just one 
of a number who called or wrote to the 
office wanting to know if they had to 
provide the information. 


The investigator identified two privacy 
issues. First, could Treasury Board (the 
employer) require employees to provide 
the location and number of their bank 
accounts for direct pay deposit? Did it 
have legal authority for collecting the 
information? 
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The Commissioner concluded that the 
government had the legal authority to 
decide how it will pay its employees. 
Collecting the necessary details to 
administer its pay procedure would not — 
breach the Privacy Act. 


However, the second issue concerned 
how the employer would deal with 
employees who refused to provide the 
information. Could it give their names, 
addresses and social insurance 
numbers to a bank to open accounts 
without their consent? 


Privacy staff had several meetings with 
Treasury Board and were told that the 
program was still voluntary—Transport 
Canada had simply been eager to 
begin. No information had been 
collected except from those who had 
opted into the program. However, the 
Board acknowledged the problem of 
handling recalcitrant employees’ pay. 


Still, with the Minister’s announcement 
in December 1989, it appeared that the 
public service was moving toward 
mandatory direct deposit. The 
Commissioner decided to hold the 
complaints open until the policy became 
clearer. 


Then, on December 15, 1990, the 
government announced that direct 
deposit would remain voluntary. The 
complainants would not have to provide 
the information and the government 
would not be opening any accounts on 
employees’ behalf. Thus, the 
Commissioner considered the complaint 
not well-founded. 


LL 


Staff relations board exhibits now 
kept two years 


Although privacy regulations require 
government agencies to hold personal 
information for at least two years, a 
complaint revealed that the Public 
Service Staff Relations Board (PSSRB) 
kept its exhibits for just three months 
before having them destroyed or 
returned to the party who presented 
them. 


The two-year period was written into the 
regulations to give individuals enough 
time to examine the material if they 
were interested. 


A woman complained that her privacy 
rights were infringed because the 
PSSRB destroyed the exhibits well 
before the two-year period. 


PSSRB explained to the privacy 
investigator that it lacked the facilities to 
keep all exhibits—items ranging from 
volumes of documents to a broken 
baseball bat, garbage cans and even a 
hangman’s noose! PSSBB staff also 
pointed out that all parties to a hearing 
receive copies of the exhibits so nothing 
was being destroyed that they had not 
already received. 


Nevertheless, the regulations are clear. 
The Commissioner concluded that 
PSSRB must keep exhibits containing 
personal information for at least two 
years after taking the last administrative 
action. The Board agreed and the 
Commissioner considered the complaint 
resolved. 


Personal information should be 
accurate 


A veteran Canada Post employee 
complained to the Commissioner that 
the post office had given false medical 
information about him to the Workers’ 
Compensation Board (WCB), in order to 
deny him benefits. 


Canada Post had told WCB that the 
employee was ineligible because his 
injury was caused by a chronic medical 
condition. According to the employee's 
supervisor, the employee had given her 
the information and she was merely 
reporting what she thought might be 
relevant to the claim. 


The employee denied having the 
condition and a recent examination by a 
specialist confirmed this. He also 
denied ever having told anyone, let 
alone his supervisor, that he had the 
condition. 


During his inquiries, the investigator 
noted a factor which may have 
contributed to the problem. Canada 
Post manages the WCB claims 
aggressively in order to minimize costs. 
It argues that it is obliged to give WCB 
any information which could question 
the validity of the claim. 


The Privacy Act requires that personal 
information being used for 
administrative purposes be as accurate, 
up-to-date and complete as possible. In 
this case there was no evidence that 
the supervisor had made any effort to 
verify that the medical information was 
accurate. 
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After protracted discussions. Canada 
Post agreed reluctantly to tell the WCB 
that it had no information to substantiate 
its allegation that the claimant had the 
medical condition. 


The Commissioner considered the 
complaint well-founded and resolved. 


Licence holders list not for surveys 


An airline operator’s call to the office 
about a Transport Canada drug use 
survey prompted the Commissioner to 
initiate a complaint of his own. 


The caller became concerned when a 
market research company asked for the 
names, addresses and telephone 
numbers of his employees. The 
company said it was conducting a 
survey for Transport Canada on 
substance use in the transportation 
industry. It needed the personal 
information to randomly select 
participants for the survey. 


The surveys, it was established, were a 
major component of Transport Canada’s 
Study to determine what risks employee 
use of drugs and alcohol posed to 
transportation safety in Canada. 
Participants were asked to complete a 
questionnaire about their use of alcohol, 
prescription, non-prescription and street 
drugs and about workplace conditions 
which could influence their using these 
substances. 
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Two areas of privacy concern surfaced: 


e Was there an improper collection of 
personal information during the survey? 
and 


e Did Transport Canada respect the 
use and disclosure provisions of the 
Privacy Act? 


Controls on use and disclosure require 
government agencies to collect only 
personal information that relates directly 
to their operating programs or activities. 
The information must be collected 
directly from the individual (whenever 
possible) unless that would lead to 
collecting inaccurate information or 
defeat the purpose or prejudice its 
intended use. And the individual must 
be told why the information is being 
collected. 


The investigation established that the 
questionnaires contained no identifying 
personal information to link them to any 
specific individual. Since the 
respondents could not be identified, the 
information was not personal and so its 
collection did not violate the Privacy Act. 


However, it was clear that Transport 
Canada compiled the list of some 
Survey participants from personal 
information it collected for other 
purposes, none of which included 
disclosing to research organizations. In 
most sectors Transport gave the survey 
company only the names and work 
telephone numbers. But, in the case of 
airport employees, its source was a list 
of employees licensed to operate airside 
vehicles and disclosing the names was 
not consistent with the original collection 
purpose and was improper. 
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The investigator also found that the 
survey companies began collecting the 
information before written contracts 
were in place. The draft contracts 
contained no references to the 
collection principles in the Act. As a 
result, representatives of Privacy, 
Supply and Services (the contracting 
authority) and Transport Canada met to 
ensure that all future contracts requiring 
personal information collection contain 
standard clauses about collection, 
retention, use, disclosure and disposal 
of information to ensure that they 
comply with the Act. 


The Commissioner also recommended 
that Transport Canada obtain the 
individuals’ consent before considering 
any future use of personal information 
that is not consistent with the original 
collection purpose. 
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Notifying the Commissioner 


During the reporting year the office 
examined 50 notices from government 
agencies advising of their intention to 
release personal information “in the 
public interest” or to benefit an 
individual. The disclosures ranged from 
confirming citizenship so that individuals 
could receive pensions or awards to 
detailed reports on escapes from federal 
penitentiaries. In fact, inmate incidents 
have become a recurring feature of the 
notification process (see page 24 for 
greater detail). 


The following are examples of other 
public interest notifications. 


DND releases security clearance 
details 


National Defence (DND) advised the 
Commissioner that it intended to give an 
employee normally exempt information 
from his security clearance file. 


In the midst of processing the man’s 
application to see his file, DND staff 
learned that provincial police had laid 
criminal charges against him, including 
one of sexually assaulting a former 
employee. His security file contained a 
military police interview with the plaintiff 
during which she detailed their 
longstanding sexual relationship. She 
had made it clear to the military police 
that it was mutually desired. 


Since the Privacy Act allows 
investigative bodies (including military 
police) to protect sources interviewed 
during security clearance investigations, 
DND would normally have exempted the 
woman's comments. They concerned 
her as well as him and it would have 
been virtually impossible to extricate 
only the man’s information from the 
record and the source of the comments 


would have been obvious. The 
department’s dilemma was that it had 
accepted in confidence information 
which appeared to contradict the 
woman's charges. The man may not 
have known about the information in his 
file and therefore be deprived of details 
vital to his defence. DND concluded it 
was in the public interest to provide him 
the information before the matter went 
to trial. 


The Commissioner notified the woman. 


Woman given details on son’s death 
abroad 


A woman asked the RCMP and External 
Affairs to tell her what they knew about 
the death of her son in Thailand. 
Although both the RCMP and External 
had been satisfied with the Thai 
investigation, and a Canadian 
pathologist had confirmed the overseas 
postmortem results, the woman still had 
questions. 


The RCMP intended to give her 21 
pages from its inquiry report, exempting 
some limited information about other 
individuals. External, meanwhile, agreed 
to provide material from files located in 
two overseas embassies and Ottawa 
headquarters. 


Normally the Privacy Act would protect 
the information—even from the man’s 
mother. But both agencies considered it 
was in the public interest to give her the 
report so that she could pursue her 
inquiries in Thailand—and perhaps put 
her mind at rest. The Commissioner 
agreed. 
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List of unclaimed dividends sought 


An applicant used the Access to 
Information Act to ask Consumer and 
Corporate Affairs for lists of unclaimed 
dividends under three acts: the 
Bankruptcy Act, the Canada Business 
Corporations Act and the Winding-Up 
Act. The applicant intended to track 
down the creditors. 


CCA advised the Commissioner that it 
would release the lists because it would 
benefit the individuals concerned 
(paragraph 8(2)(m)(ii)). The 
Commissioner agreed but admitted to 
“lingering unease about the need for this 
disclosure”, observing that if 
government institutions are reasonably 
able to locate individuals to whom they 
owe money, they should do so. He 
concluded that it “seemed less than 
ideal” to disclose personal information 
without consent to permit third parties to 
locate creditors (presumably for a fee). 


Poor catch for Revenue Canada 


Fisheries and Oceans advised the 
Commissioner that it intended to provide 
Revenue Canada’s GST 
Communications Office with a mailing 
list of commercial fishermen. The GST 
office wanted to send fishermen an 
information booklet explaining how they 
should “charge, record, calculate and 
send in the tax”. Revenue Canada had 
no other way of reaching fishermen and 
Fisheries concluded that clearly it was in 
the fishermens’ interest to receive the 
material. 
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The Commissioner was not so Sure. 
The GST legislation had not then been 
passed and, while it might be helpful, 
he was not convinced disclosure of the 
list would “clearly benefit” fishermen. 
However, he told Fisheries he had no 
objection to their mailing the material 
for Revenue Canada. 


The Fisheries department could not find 
sufficient “public interest” to warrant its 
mailing GST material. It did, however, 
provide Revenue Canada with a list of 
fishermen’s associations. 


Board members’ names not 
“personal” 


The International Development 
Research Centre (IDRC) told the 
Commissioner it would release the 
names of board members who had 
attended an IDRC meeting in Bangkok, 
Thailand. The centre had given a 
journalist (who applied under the 
Access to Information Act) the 
members’ expense accounts, but not 
the names. The journalist complained 
to the Information Commissioner who 
recommended release. 


After discussing the notification with 
IDRC staff, the Privacy Commissioner 
agreed with the Information 
Commissioner that the board members 
were officers of the centre and so their 
expense accounts would not normally 
be “personal information”. However, in 
preparing the initial package, IDRC had 
provided more detail than was 
necessary—-menu selections, 
insurance policy numbers, the credit 
cards they held and—in one case—the 
member’s American Express Card 
number. 
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This level of detail went beyond the 
requirements of public accountability. 
Having made the mistake, IDRC could 
not then withhold the names. The 
Privacy Commissioner accepted the 
notification and IDRC advised its board 
members of the release. 
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Policy and Research 


Data matching 


Electronic data processing poses its 
own threats to privacy. For example, 
the uncontrolled linkage of computer 
files could produce extensive dossiers 
on everyone, making a mockery of the 
collection restrictions set out in the Act. 


To guard against this, the government 
introduced a data matching policy 
requiring that departments submit 
detailed proposals to the Privacy 
Commissioner 60 days in advance of 
linking databases.The policy, little more 
than a year old, applies a brake to 
untrammelled data linkage by ensuring 
that this independent agent (the Privacy 
Commissioner) weighs the proposals 
against a set of approved criteria. The 
Commissioner also acts as an advocate 
for those who may be affected by the 
match. 


However, some departments seem to 
view the Commissioner’s role as 
something of a rubber stamp to be 
applied after a last minute phone call. 
But Treasury Board’s policy is clear — 
and the Commissioner’s assessment is 
serious. Notifying the Commissioner 
when the system is on the launchpad 
will only frustrate everyone and cause 
delays. 


This year the Commissioner's staff 
examined 11 proposals resulting from 
this policy. Following is a brief 
description of each match and the 
office’s conclusions. Anyone wishing 
greater detail on these — or guidance 
on formulating their own proposals — 
should call the office. 


Matching Employment and 
Immigration Canada Adjustment 
Assistance records with Toronto 
welfare files 


Federal, Ontario and Toronto officials 
formed a committee to grapple with 
some of the problems caused by the 
increasing number of refugee claimants 
on Metro Toronto welfare rolls. 


One of the problems was determining 
whether a refugee is receiving financial 
support from Employment and 
Immigration Canada’s Adjustment 
Assistance Program. The program 
provides refugees with funds until they 
have sufficient income to support 
themselves or for one year, whichever 
comes first. Refugees benefitting from 
this program are ineligible for welfare. 


The committee was concerned that, 
without some type of verification, both 
programs could be subject to fraudulent 
claims. Members agreed that EIC and 
Metro Toronto should share data to 
prevent such occurrences. 


At first, EIC considered the match a 
“consistent use” and offered 

the Commissioner little substantiation. 
However, after a good deal of 
consultation, EIC provided a rationale 
and set out the legislative base for data 
sharing. 


The Commissioner was satisfied but 
asked EIC to follow Metro Toronto’s 
lead and tell applicants that the 
government agencies would verify their 
eligibility. He further asked EIC to adda 
notice and consent statement to the 
application forms as well as to assess 
whether the match reduced fraud cases 
enough to justify the action. EIC 
agreed. 
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External Affairs INFONNEL project 


Last year’s annual report said External 
Affairs had asked that the office 
examine its proposed new personnel 
management system which would 
incorporate smaller data bases into a 
single system with more sophisticated 
processing capabilities. The system 
would allow management to forecast, 
track and record all personnel actions. 


Privacy staff became concerned that the 
proposed degree of integration might 
well exceed Treasury Board’s approved 
uses of this type of database and that 
the proposal did not provide enough 
detail on system security. The staff 
concluded that the system design did 
not meet the requirements of either the 
Privacy Act or the government security 


policy. 


Follow-up documents and discussions 
have failed to resolve the difficulties. 
Thus the office’s audit branch will 
examine the system. 


Agriculture Canada's Security 
Information System. 


Agriculture Canada consulted the office 
on its plan to transfer some personal 
employee data from its human resource 
system to a security information system. 
Agriculture came to the office early in 
the process with a proposal for a 
“cleansing match’— one which simply 
verifies or updates a data base. The 
proposal set out the rationale for 
considering the transfer a “consistent 
use” and acted quickly to amend the 
bank descriptions to reflect the changes. 
In this example, Agriculture respected 
the policy and the result was a painless 
and speedy review. 


The Personal Locator Beacon 
Registry 


The office gave its seal of approval to a 
new Department of Communications 
system containing data on owners of 
“personal locator beacons”. The 
devices are small, portable transmitters 
which campers, canoeists and hikers 
carry and activate in an emergency. 
The beacon transmits a radio signal to 
facilitate search and rescue. 


Communications proposed to set up a 
voluntary registry containing such data 
as owners’ names, addresses, type of 
vehicle and activity (land, marine or air) 
and next of kin. The registry, available 
to National Defence and the RCMP, will 
also be linked to DND and Transport 
Canada’s joint search and rescue 
information system. 


The registry is entirely voluntary and 
limited to this specific purpose. 
Participants sign a consent form and are 
told of the disclosures. Finally, all 
personal data will be stored in a newly- 
created personal data bank and listed in 
the Info Source guide. 


Managers’ new career counselling 
service 


The office also had no difficulties with a 
Public Service Commission proposal to 
create a registry for its new confidential 
counselling service to help improve 
managers’ skills. 


The service is voluntary and within 
PSC’s mandate. Participants provide 
the information directly and are told how 
it will be used. PSC will set up a bank to 
contain the data. 
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GST and SIN 


A Revenue Canada notification on data 
linkages required by the GST has not 
been so clean. 


Early in 1990, the Revenue minister 
advised the Commissioner that the GST 
program would involve some data 
matching and would use the social 
insurance number to register individuals 
and sole proprietorships. The minister 
assured the Commissioner that 
Revenue Canada took its clients privacy 
very seriously and promised a detailed 
submission “within the next few 
months”. 


Now, the legislation has been passed, 
detailed regulations have been adopted 
on sharing information and the use of 
SIN and still the Commissioner awaits 
the promised “detailed submission”. In 
fact, only late in 1990 has the 
department begun to consider the data 
matching implications. This office has 
pressed for details but without success. 


Fishing licence and vehicle match 
withdrawn 


Fisheries and Oceans abandoned a 
project to step up fishing regulation 
enforcement by matching fishing licence 
holders with fishing vehicle permits. 
Fisheries withdrew the proposal when it 
became apparent that there was no 
legal justification for the match. 


Immigrants’ health records match 


Health and Welfare Canada submitted a 
proposal to assess immigrants’ overall 
health by linking its Immigration Health 
Services Records with provincial 
medical records. 


The department proposed to extract 
Statistical data only and promised not to 
use it for administrative purposes. 


Technically this type of match does not 
require the Commissioner’s review but 
the office appreciated being advised. 
Health care matches are a sensitive 
area which continue to worry the 
Commissioner. 


Correctional Services’ information 
gathering 


CSC advised the Commissioner’s office 
of a proposal to improve its gathering of 
“critical information” on persons about to 
be admitted to the penitentiary 
population. The need for better 
information became apparent after two 
recently-released federal inmates 
committed murders in Toronto. 


When an inmate arrives at a federal 
facility, CSC requests information from 
the police, courts and various 
correctional and parole authorities. 
Agencies often do not give these 
requests high priority and CSC is left 
without critical information on which to 
determine the inmate’s proper security 
level or the possibilities for parole. The 
problem is most acute in Metro Toronto. 


As a result, CSC proposed contracting 
with former Toronto police officers to 
coordinate assembling the information. 


The office examined these contracts to 
ensure that clauses covered 
contractors’ collection and use of the 
personal information, that the collection 
procedure itself complied with the 
Privacy Act and that any information 
collected would be stored in a bank and 
made available to the individuals. CSC 
had taken all of these concerns into 
account. 


The office noted that such release to 
provincial agencies might require review 
by the Commissioner’s provincial 
counterparts. The staff also 
recommended that federal provincial 
agreements be drafted to cover the 
exchanges. 


CIDA overseas student inventory 


The Commissioner’s office continues to 
struggle with a Canadian International 
Development Agency (CIDA) project to 
establish an inventory of CIDA-funded 
students from overseas. 


CIDA’s own files are organized by 
project or country, making it difficult to 
retrieve individuals’ names and 
addresses. To solve this, CIDA 
proposed a tracking system that would 
link Employment and Immigration 
student authorization files which contain 
the information CIDA wanted. To 
accomplish this, it intended to send an 
employee to search the EIC files. 


Despite privacy staff cautions that no 
legal authority could be found for the 
exchange, CIDA submitted a formal 
proposal. During discussions with 
Employment and Immigration it became 
apparent that their staff knew little about 
the proposal and — like privacy staff — 
could find no legal basis for this linkage. 
They also did not intend to comply. 


As a result, CIDA asked for more 
consultation time and since then has 
submitted two different proposals. 
Examining the match did, however, 
reveal an oddity — CIDA lists no 
personal data banks for students and 
trainees in the Info Source guide. This 
was brought to the attention of Treasury 
Board which is responsible for ensuring 
government agencies comply with the 
Privacy Act. 


Offsetting debts against income tax 
refunds 


Probably one of the longest-standing 
data matching assessments concerns 
the government use of SINs to identify 
persons who owe money and to deduct 
the amounts owed from income tax 
refunds. 


In June 1990,-the Office of the 
Comptroller General proposed a 
research project to assess the 
usefulness of such a program to recoup 
some of the $800 million owed to the 
Crown for overdue student loans. The 
office agreed to a research match but 
held that deductions from tax refunds 
should not begin without legislative 
amendments. 


The office also wanted to be assured 
that money would not be deducted 
solely on the basis of “a hit’— simply 
appearing on both lists. A principle of 
data matching schemes requires that 
there be some independent verification 
before taking any administrative action. 


These differences of opinion remained 
unresolved by February 1991 when the 
government tabled its budget. It did 
mention changes to allow government 
to recover money owing from tax 
refunds. 
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Apparently individuals will be given fair 
warning and special care will be taken 
to ensure that the deductions from 
refunds will not cause undue financial 
hardship. 


Nevertheless the office maintains that 
this type of debt collection will require 
legislative amendment and not simply 
the mandate of the Financial 
Administration Act or claims that such 
behavior represents either “consistent 
use” of the information, or disclosure “in 
the public interest’. 


Technology Marches On 


Employment and Immigration (EIC) is at 
the forefront of applying new systems 
technology to its workplace. This fact is 
not surprising considering the 
department serves about 3,000,000 UI 
clients, receives some 40,000,000 
claimants’ reports and handles 
31,000,000 inquiries each year. 


Smart Cards 


EIC has briefed our office on a pilot 
project to use “smart cards” for 
unemployment insurance clients. The 
cards resemble most bank or credit 
cards but are really mini computers 
containing 64K memory—as powerful 
as some of the early personal 
computers. Clients applying for benefits 
would use the card to report periods of 
unemployment through publicly 
available machines. EIC mainframe 
computers would then determine the 
claimant’s eligibility, calculate the 
benefits and credit the payment onto the 
card. The claimant could then use the 
card to withdraw cash from an 
automatic teller machine or make 
purchases through retail direct debit 
machines. 


The pilot project is expected to begin in 
two locations in the fall of 1991. 


There are two clear privacy issues: 
ensuring that the correct person is 
accessing the system; and safeguarding 
against matching the data with other 
unrelated personal information. 


Access appears to be controlled. 

Clients enter the system using a 
personal identification number (PIN) 
which they have selected. There are 
highly sophisticated internal security 
safeguards which EIC believes cannot 
be compromised. EIC will watch system 
security closely during the pilot project 
and brief the Commissioner. 


The second concern, protecting against 
data linkage, has also been taken care 
of. Internal safeguards will prevent the 
card from being used for any other 
transactions and bank and retail 
machines will be limited to receiving the 
funds for the transaction. 


However, EIC sees the single card 
eventually being used for as many as 
eight different applications. For 
example, cards could link the holder to 
an electronic job-search database 
describing available jobs which match 
their training and experience. Or they 
could be used to verify and pay training 
allowances and place the holder on 
training programs. 


With so many possible functions, the 
cards could be useful for other 
government agencies or even private 
companies. EIC could sell them unused 
space for data or financial transactions. 
However, EIC recognizes that multiple 
uses would require segregation of the 
functions to prevent merging or cross- 
over of the data from one program to 
another. 
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Much of this project is still in the 
conceptual stage. EIC estimates it will 
take three to four years to start the Ul 
program, another three to four years to 
implement and a total of 10 years for 
multiple applications. The scope of this 
project may require amendments to EIC 
legislation. Our office has suggested 
that any changes should focus on 
protecting the card and the transaction 
process, rather than simply authorizing 
its use. 


EIC’s new telephone inquiry system 


The Commissioner's office remains 
concerned about Employment and 
Immigration’s Automated Voice 
Response Enquiry System (AVRES). 
This pilot project allows touch telephone 
users to get general unemployment 
insurance information or details about 
their own claim over the phone. Callers 
use the phone keypad to select options 
and identify themselves by entering 
their social insurance number and date 
of birth. The technology permits 
computers to answer thousands of 
routine calls. 


The office learned about the system 
when a Quebec City radio station 

asked us whether this was a proper use 
of SIN. There is no doubt that EIC can 
use the SIN—it was devised for the UI 
program. However, our office was 
concerned that individuals’ SINs and 
dates of birth are so widely available 
that using them for identification does 
not restrict access to that individual. 


Recognizing the weakness of SIN and 
date of birth, EIC looked at other 
solutions—client waivers, system 
recognition of the client's phone number 
or a client-chosen personal identification 
number (PIN), similar to bank card 
numbers. Although PINs appear to be 
the best solution, this would require a 
year for development and the pilot 
project was on the verge of launching 
into Ontario. With mounting internal 
pressure, Treasury Board approval and 
the system about to go to tender, EIC 
decided to proceed. 


The Commissioner conceded that EIC 
was best suited to decide how to use 
technology to serve the public. 
However, he urged the department to 
hold off until more secure protections 
were in place, observing that EIC was 
courting the risk of embarrassment and, 
possible improper disclosure of a 
client’s information. 


Alas, it was too late—the project had 
already expanded to London and 
Peterborough. EIC believes the 
expanded pilots will enhance 
development and perfect a new security 
gate for the national system. 
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Consulting the Commissioner 


The Commissioner's Office always 
welcomes opportunities to exchange 
information with those interested in the 
progress of privacy protection. Often 
such inquiries are outside the office's 
scope so it acts as a privacy clearing 
house, assembling material or referring 
inquiries to other sources. For example, 
research staff handled requests from 
Australia's new federal privacy 
commissioner for background on 
Canadian medical research guidelines, 
the application of federal data matching 
policy to law enforcement, security and 
intelligence data and Canada's 
experience with covert surveillance. 


The Commissioner received other 
requests from down under as well. 
Privacy committees asked for the 
Commissioner's general assessment of 
the Privacy Act and his office's 
experience. The Australian electoral 
commissioner wanted information on 
Canadian legislative protection of 
whistleblowers (there is none) and 
Telecom Australia was interested in 
Canada's handling of caller ID and call 
management phone services, as well as 
codes of conduct for telecommuni- 
cations companies. 


The Hong Kong Secretary for Home 
Affairs, researching data protection 
legislation, needed information on 
registering computer systems and 
licensing data banks. Both these 
controls are features of some strict 
European data protection schemes— 
particularly the British Data Protection 
Act. They are not part of any Canadian 
legislation so his inquiry was referred 
elsewhere. 


The Commissioner's staff also provided — 

provincial counterparts with eng 

information on 

e federal data matching experience 
(Ontario); 

e the privacy implications of linking 
health care and socio-economic 
records (Quebec). 


The staff also assembled the latest 
federal material on informatics 
applications of government databases 
and a management framework for 
disseminating corporate affairs 
databases. This was in response to a 
request from the Ontario Ministry of 
Consumer and Commercial Relations _ 
for information on the privacy 
implications of public data bases. 


The Royal Commission on New 
Reproductive Technologies asked the 
Privacy Commissioner for input on the 
privacy implications of the new 
reproductive techniques. The 
Commissioner intends to make a 
submission once the genetics study Is 
complete, In the meantime, he 
welcomed the consultations. 


Inquiries 


Inquiries to the office continue to climb. 
Inquiries officers handled 4,032 calls 
and letters, compared with 3,447 the 
previous year—an increase of 17 per 
cent. 


Fifty-five per cent of the inquiries 
concerned the use of or interpretation of 
the Act. Here are some examples: 
Canada Post employees asked 
whether they had to sign a consent to 
release their medical records to the 
employer; inmates questioned whether 
penitentiaries could open their mail; and 
Transport Canada’s privacy office 
wanted to know whether a person’s 
voice (on an audio tape) is considered 
personal information. In each case, the 
inquirers were referred to Treasury 
Board or the Department of Justice for 
interpretation. 


The second largest inquiry category— 
17 per cent—comprised calls about 
privacy problems outside the 
Commissioner’s jurisdiction. Four per 
cent of these inquiries concerned 
federal agencies and Crown 
corporations not covered by the Act. In 
One instance, a correctional officer was 
upset because he was shown on a CBC 
telecast. Apparently the cameraman 
had assured him he was not filming but 
Simply adjusting the lens. The man 
worried that appearing on camera could 
endanger his life and that of other 
guards who are sometimes threatened 
by inmates. Since CBC is not covered 


by the Act, the office could offer no help. 


The other 13 per cent of these inquiries 
were about other levels of government 
or—frequently—the private sector. For 
example: A woman called to enquire 
about a job application given her by the 
Canadian Imperial Bank of Commerce 
(CIBC). The form asked for consent to 
disclose personal information from 
credit agencies and former employers 
and included a statement that 
“permission includes my consent to the 
release of personal information 
concerning me within the meaning of 
subsection 8(2) of the Privacy Act’. 


This puzzled the Commissioner's staff 
on two counts: 

¢ the banks are not subject to the Act; 
and 

* section 8 says that government may 
not disclose personal information 
without the individual’s consent. 


The subsection cited describes the 
exceptions to the rule, none of which 
could be remotely interpreted as 
including release to prospective 
employers! 


Staff concluded that the statement had 
no legal effect and did not dilute the 
protection of information held by the 
federal government. Legal counsels for 
both the office and CIBC discussed the 
consent, but, without jurisdiction, the 
Commissioner could not have the 
reference removed. And the bank has 
not apparently done so voluntarily since 
the office has received another 
complaint. 


The most frequent Social Insurance 
Number (SIN) complaints (13 per cent 
of inquiries) cite insurance companies, 
video rental outlets, banks, grocery and 
department stores. Callers are amazed 
and unhappy that restrictions on uses of 
the SIN apply only to the federal 
government. 


Several callers focused their anger on 
the Royal Bank’s Gold Card application. 
The agreement requires applicants to 
consent to a blanket collection and 
disclosure of the SIN if they supplied it 
“in any application” to the bank. The 
office is inquiring whether opening a 
bank account (for which customers must 
supply a SIN under the Income Tax Act) 
is “an application”. 


Finally, eight per cent of inquiries were _ 
unrelated. A number of these deal with | 
applying for a pardon and they are | 
referred elsewhere. But many are from | 
frustrated taxpayers who find in the | 
office’s toll-free line an opportunity to 
talk to a real person who works for “The | 
Government”. | 
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Compliance Directorate 


The directorate’s objectives for 1990-91 
included auditing three major 
institutions, evaluating and improving 
the audit process and product, 
developing a privacy awareness 
component to audits and establishing an 
effective audit process for personal 
information held in electronic data 
processing (EDP) systems. 


The office selected National Defence, 
the Royal Canadian Mounted Police and 
External Affairs, three institutions which 
hold the most sensitive and wide- 
ranging banks of personal information 
and operate some of the most 
sophisticated information handling 
systems in the country. While the war in 
the Persian Gulf and the Oka crisis at 
home had a serious impact on the 
success of the planned audit program, 
staff completed auditing the RCMP and 
DND and issued an interim report for 
External Affairs. 


Due to the logistical problems and 
expense associated with international 
travel, the office has deferred its audit of 
External’s overseas operation and the 
detailed review of its international 
information processing systems. 


These agenda changes meant that the 
office could begin three smaller audits 
late in 1990; the National Capital 
Commission, the Office of the 
Comptroller General and the 
Commissioner of Official Languages. 
One of these, the Commissioner of 
Official Languages, was completed by 
year end. 


The directorate now offers a “privacy 
awareness component” as part of its 
audits. Audit teams provide on-site 
presentations on the Privacy Act and 
have available two video cassettes 
which graphically illustrate the concerns 
pursued in the compliance audit. The 
videos are used only when the client 
institution chooses to become more 
informed. 


All this year’s investigations included an 
improved audit of information in 
computer systems. These new 
procedures and processes were used at 
DND, the RCMP and the Office of 
Comptroller General (OCG). In fact the 
OCG audit focussed entirely on EDP. 
Experience gained in these 
investigations will result in production of 
specific manuals and guides for this 
audit component. 


The office was also involved in the 
following special investigations or 
projects: 


¢ Cellular phone spectrum searching 
by the RCMP; 


¢ CSIS establishment of an exempt 
bank; 


e Indian Affairs and Northern 


Development (DIAND) internal 
audit; 
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® concerns about upward evaluation 
in Industry, Science & Technology 
and DIAND; 


e the request for the release of Bell 
Canada technical information to 
the Criminal Intelligence Service of 
Ontario. 


AUDIT FINDINGS 
Royal Canadian Mounted Police 


The audits to date have shown that the 
RCMP in particular has made a 
concerted effort to ensure that it 
complies with the Privacy Act. It has 
made privacy considerations a high 
priority, undertaking periodic information 
sessions at all levels and introducing 
training on the Privacy Act as part of the 
curriculum both for new recruits and 
officer trainees. 


Although auditors found instances 
where personal information holdings 
were not adequately described in the 
Personal Information Index (now Info 
Source), these were due either to 
oversights or to descriptions not keeping 
pace with changes in operating 
procedures. 


Some records containing personal 
information were not being disposed of 
in accordance with approved schedules 
and Privacy Regulations. This was 
particularly true with the disposal of 
performance logs (a type of manager's 
diary to record employees' daily 
performance). The logs were the 
subject of numerous meetings between 
privacy staff and RCMP privacy 
personnel, all seeking a solution that 
would satisfy both the privacy 
requirements and the force’s 
administrative needs. 
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The audits found some instances of 
personal information not being 
adequately protected against 
unauthorized disclosure. The most 
serious involved the Victims Assistance | 
Program where auditors found that | 
volunteer counsellors have been given 
access to complete investigation files. | 


Two areas of particular interest | 
examined during the RCMP audit were | 
facsimile (FAX) transmission and using | 
micro-computers to handle personal | 
information. It is apleasure to report | 
that the RCMP has specific policies and | 
procedures on transmitting personal | 
information by FAX and handling it by | 
micro-computer. These controls ensure | 
that sensitive personal informationis 
transmitted only through the RCMP’s 
own secure communications facilities. 
Auditors inspected a number of 
computer systems and found evidence © 
that the personal information they | 
contained was properly protected. 


National Defence (DND) 


The office has reported its detailed 
findings to National Defence and is 
awaiting management's response. The 
practice is not to describe audit findings 
publicly until staff have had an 
opportunity to examine the department's 
comments and discuss any areas that 
may be in dispute. 
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Other audits 


Other audits disclosed that retention 
and disposal standards are not always 
upheld or are inadequate. There was 
evidence that personnel files are not 
generally disposed of on time and some 
personal information banks have 
indefinite retention periods. Some third 
party information, which could be 
inadvertently disclosed, is found on 
personnel files. Sensitive and 
inappropriate information is often found 
on some personnel files and the need- 
to- know principle is not in place in most 
institutions. The security for personal 
information held by many institutions is 
inadequate, while descriptions for many 
information banks are inaccurate. 


In fairness, however, most personnel 
expressed interest not only in the audit 
objectives but also in the proper 
application of the Privacy Act throughout 
their institutions. In a number of cases 
Staff corrected problems before the 
privacy investigators left. 


Among smaller institutions with fewer 
resources to spend on applying the Act, 
there tend to be greater opportunities for 
inappropriate handling of personal 
information. Policies and procedures 
tend to be out of date or absent and 
general knowledge of the Act is 
consistently lower than in the major 
departments. The security of personal 
information collected by these 
institutions is usually at risk. 


So it is refreshing to report on a smaller 
institution which generally handles 
personal information in accordance with 
the Privacy Act. 


Office of the Commissioner of 
Official Languages 


Throughout the audit of the Office of the 
Commissioner of Official Languages it 
was evident that although most 
employees had only a cursory knowledge 
of the Privacy Act, all had a high degree of 
concern for the proper management of 
personal information. Auditors agreed 
that this concern reflected the provisions 
in the Official Languages Act dealing with 
the confidentiality of complaint 
investigations. 


Yet, there were instances of personal 
information not being adequately 
protected against unauthorized 
disclosure and in one case, the 
computer system’s security features had 
been rendered inadequate due to 
improper administration and protection 
of passwords. 


Common findings 


Overall, some of the most common 
observations in all audits were: 


Inadequate protection of personal 
information 


e Managers, supervisors and other 
employees are allowed to see 
personnel files for routine 
administrative purposes. Records 
Staff have access to their own and 
each others' personnel file, allowing 
them to see sensitive personal 
information for which they have no 
“need-to-know’”. (e.g. - Personal 
History Forms, results of credit and 
reference checks, medical diagnosis, 
details of family members, 
designation of beneficiary, Canada 
Savings Bonds purchases, United 
Way contributions, etc.) 
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Some files contained a limited 
amount of third-party personal 
information, usually when the 
subject’s name is on a list with other 
employees, often including 
everyone’s Social Insurance 
Numbers. 


Usually personal information handled 
by microcomputers is not adequately 
protected either by external security 
provisions (keyboard locks, hard disc 
protection, etc.) or internal protection 
(accounts, IDs, passwords, partitions, 
backup, etc.). 


File jackets tend to bear the 
particulars of an individual along with 
the caption of the file. This is 
especially pertinent where the file 
relates to investigations, complaints 
or special requests. For example, 
one personal file jacket included 
notations about a sexual harassment 
allegation, including the victim's 
name. The information was clearly 
visible to mail clerks or anyone who 
saw the file on a desk. 


Improper disclosure of personal 
information 


Personnel records often contain 
documents that should have been 
purged from the file or retained on 
other files. Individuals’ medical 
information and security-related 
material are found in up to 10 per 
cent of the records sampled. 


Misuse of personal information 


e Information properly collected for | 


specific purposes is sometimes used | 
for follow-on purposes (e.g. personal | 
harassment files used for grievance — 
and discrimination cases). 


Improper retention and disposal 


e Many banks have improper retention | 


and disposal schedules and proper 
schedules are not being maintained. 


Corporate Management 


Corporate Management provides both and 78 person-years, an increase of 

the Information and Privacy $567,905 and three person-years over 

Commissioners with financial, 1989-90. Personnel costs of 

personnel, administrative, informatics $4,897,442 and professional and 

and library services. special services expenditures of 
$577,300 accounted for more than 87 

Finance per cent of the total. The remaining 


$852,060 covered all other expenses. 
The Offices’ total resources for the 
1990-91 fiscal year were $6,372,000 


The following are the Offices’ expenditures 
for the period April 1, 1990 to March 31, 1991* 


Corporate 
Information Privacy Management Total 

Salaries W6G9 527 1,856,590 652;525 4,194,442 
Employee Benefit 
Plan Contributions 288 230 eOU 91,390 703,000 
Transportation and 
Communication 38,141 114,167 sP-XC RCL O)S) Hai he Vo VW 
Information 84,446 58,546 5,549 148,541 
Professional and 
Special Services 411,801 130,150 35,349 577,300 
Rentals 3,952 2,214 11,413 17,579 
Purchased Repair and 
Maintenance 14,628 3,919 9,676 282238 
Utilities, Materials 
and Supplies 9,847 14,978 30,655 55,480 
Acquisition of Machinery 
and Equipment 176,236 51,508 85,672 313,416 
Other Payments 6,145 3,475 3,584 13,204 

TOTAL 2 f18;753 2,558,927 1,049,122 6,326,802 


“Expenditure figures do not incorporate final year-end adjustments reflected in the 
Office’s 1990-91 Public Accounts. 


Personnel 


An increase of three person-years and a 
change of both the Privacy and the 
Information Commissioners contributed 
to an active personnel program. There 
were 45 staffing actions, including 
outside recruitment, promotions, the 
hiring of term employees and some 
reclassifications. 


Administration 


New space was fitted-up for occupancy 
in the fall of 1990 and some progress 
was achieved in the records 
management area, particularly in the 
scheduling of administrative records. 


Informatics 


A new information technology was 
introduced to the organization. Three 
studies were undertaken concerning 
case management systems, additional 
office automation and networking ina 
secure environment. These studies will 
be completed in 1991-92 and will 
provide the necessary information to 
form a long-term information technology 
plan. 
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Library 


The library provides services to the 
Information and the Privacy 
Commissioners. It is a resource centre 
for both the Information and Privacy 
Staffs which is also open to the public. 


A total of 436 books, periodicals, and 
annual reports were acquired through 
the Government Depository Services 


program. There were 835 items loaned 


and 847 reference questions answered. 


The automation of library functions was — 


completed this year. 
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Front Cover: The new "smart cards" look like bank or credit cards but there is 
an essential difference. Imbedded in the card Is a computer chip to process 
and store data and to identify the owner. The symbols illustrate the range of 
services and personal information that may soon be stored on one small piece 
of plastic. They are: 


@ Telephone calling card @ Retail purchases 

@ Bus pass @ Medical records 

@ Federal benefits @ Computer system access 

@ Banking services @ Residence and workplace access 
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The Honourable Guy Charbonneau 
The Speaker 

The Senate 

Ottawa 


August 12, 1992 


Dear Mr. Charbonneau: 
| have the honour to submit to Parliament my annual report. 


This report covers the period from April 1, 1991 to March 371, 
92. 


Yours sincerely, 


Bruce Phillips 
Privacy Commissioner 
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The Honourable John Fraser, PC., Q.C., M.P 
The Speaker 

The House of Commons 

Ottawa 


August 12, 1992 


Dear Mr. Fraser: 

| have the honour to submit to Parliament my annual report. 
This report covers the period from April 1, 1991 to March 31, 
1992. 


Yours sincerely, 


Bruce Phillips 
Privacy Commissioner 
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Mandate 


The Privacy Act provides individuals with access to their 
personal information held by the federal government; it 
protects individuals’ privacy by limiting those who may 
see the information; and it gives individuals some 
control over the government's collection and use of the 
information. 


The Act sets out the principles of fair information 
practices, requiring government to : 


e collect only the information needed to operate its 
programs; 


e collect the information directly from the individual 
concerned, whenever possible; 


e tell the individual how it will be used: 


e keep the information long enough to ensure an 
individual access; and 


e “take all reasonable steps” to ensure its accuracy 
and completeness. 


Anyone in Canada may complain to the Privacy 
Commissioner if: 


e they are denied any part of the information; 


e they are denied their request to correct some of the 
information on the file — or their right to annotate it; 


e the department takes longer than the initial 30 days 
or maximum 60 days to provide the information; 


e the /nfo Source description of the contents of an 
information bank is deficient in some way; 


e the department’s listing in the Source does not 
describe all the uses it makes of personal 
information; 


¢ an institution is collecting, keeping, using or disposing 
of personal information in a way which contravenes 
the Privacy Act. 


The Privacy Commissioner's investigators examine any 
file (including those in closed banks) except confidences 
of the Queen’s Privy Council to ensure that government 
institutions are complying with the Act. 


The Act also gives the Privacy Commissioner the power 
to audit the way government institutions are collecting, 
using and disposing of personal information. 


The End of the Beginning? 


It may be tempting fate beyond prudent limits. 
Nevertheless, with crystal ball and reputation in hand, 
the author is willing to venture the opinion that the 
privacy picture is getting a little better. 


Not yet the sunlit uplands, to be sure: disaster areas 
abound, and the rubble of many a previous privacy 
defeat remains untouched. 


But, carrying Churchillian paraphrase to unreasonable 
limits, one senses that, while we are a long way from 
the beginning of the end to privacy problems, we may be 
close to the end of the beginning. 


In plain talk, we seem to be getting somewhere. 


During the year under review, there were a number of 
developments on several fronts which suggest the slow- 
gathering defences of privacy are starting to make 
themselves felt. 


Both inside and outside of government there were 
hopeful signs of greater recognition of the problems 
affecting privacy, and a greater willingness to seek 
remedies. To itemize a few of the more outstanding 
ones: 


e Two more provinces, British Columbia and 
Saskatchewan, are in the process of creating privacy 
protection schemes. A third, Alberta, is considering 
similar action. Inclusion of these three provinces would 
extend some form of data and privacy protection at 
provincial levels from Quebec to the Pacific Coast. 


e Federal legislative activity in the fields of tele— 
communications and financial institutions stimulated 
refreshingly intense focus on their privacy implications, 
both by the government and in Parliament. Some of the 
proposed responses, still under study as this report 
goes to press, could point the way to a breakthrough in 
the difficult problem of achieving higher levels of privacy 
protection in the private sector. 


¢ Some of the major players in the commercial field are 
responding more energetically to the rising level of 
public concern about the way business handles personal 
information under its control. Notable in this respect 
are Canada’s direct marketers, who are working on a 
code of practice which, if adopted, offers promise that 
those among us who do not wish to receive unsolicited 
mail and telephonic sales pitches will be provided with a 
convenient and well-publicized method of avoiding them. 


e Though technically not within the year, there was a 
landmark decision by the Canadian Radio and Tele— 
communications Commission (CRTC) in the case of “Caller 
ID". It established a critical precedent by ruling that 
telephone subscribers who wished to preserve the 
anonymity of their telephone numbers would not have to 
pay a special charge. This ruling clearly recognized that in 
telecommunications, privacy is recognized as a consumer's 
right, and not merely as a commodity for sale. 


some of these developments will be discussed in more 
detail later in this report. They do not constitute in any 
way a comprehensive account of all that has happened 
in the many areas of life and commerce which had an 
impact on privacy during the year. They are presented 
as examples of a hopeful trend. Taken singly or 
together, they represent something considerably less 
than dazzling victories, but something considerably more 
than deadlock. 


However, they must be viewed in the context of the 
larger problem. For example, all the earnest jawboning 
of privacy advocates so far has had almost no impact on 
the biggest and most serious privacy issue of all, which 
is the vast and unregulated traffic in personal 
information, a business whose monetary value in North 
America runs into the billions of dollars. A society which 
casually accepts the existence of dossiers of unknown 
accuracy in unknown hands on millions of individuals, 
and with no rights of access and correction, is a society 
which ts recklessly indifferent to preserving that most 
basic privacy right: the right to some control over what 
others know about you. Yet this is the situation as it 
now stands. There is scarcely one among us whose 
name is not to be found in one, and probably more of 
those dossiers in the computer banks of the list-makers 
and the list-marketers. 


It is, though, an indifference born largely of ignorance. 
There is ample and heartening evidence that wherever 
and whenever the public at large clearly understands 
the issues and Is given an opportunity to influence them, 
whole armies rise up to mount privacy’s barricades, 
sometimes with dramatic results. 


Item: a couple of years ago, a telephone company in the 
United States asked its subscribers whether they 
objected to their information in the company files being 
sold off to other companies. Eight hundred thousand of 
them so objected, and the idea was dropped. Likewise, 
a scheme involving one of the major software 
companies in the United States to market a machine- 
readable disc containing information on eighty million 
persons provoked such a storm of controversy that it 
too was discarded. 


Public reaction — often angry — to the explosion of 
direct marketing illustrates the critical importance of 
wider knowledge about the issues. While not implying 
that marketers are devoid of a sense of responsibility, it 
would be naive not to acknowledge that it is public 
concern about the means by which these firms acquire 
their information which is injecting fresh impetus into 
the industry’s efforts to develop an improved privacy 
code. 


Thus greater public understanding of privacy issues in 
the modern technological context is a desperate 
necessity. VVhat simpler and more graphic proof is 
required than our recent experience with cellular 
telephones? 


Many people were surprised to learn from our last 
annual report that conversations over cellular 
telephones could be monitored with easily-obtained 
scanning equipment. The revelation has not lessened 
the public affection or appetite for these extremely 
useful inventions, but we're willing to wager it has made 
many people considerably more sophisticated or 
guarded in their use of them. 


All that was ever missing in the cellular phone revelation 
was adequate information. Mass media coverage of the 
observations of this office helped to fill the information 
gap. But one would never have been created in the first 
place had industry been required to ensure that its 
clientele was provided with all the information needed to 
make informed decisions about the equipment. 


The obligation to inform rests upon both the private and 
public sectors. In the latter area, the only national 
agency which seeks to maintain an overview of the 
entire privacy field is the Office of the Privacy 
Commissioner. It is, therefore, the natural body to play 
a lead role in the area of public education and 
communication. Yet it is a fact (which even some 
parliamentarians are surprised to discover) that the 
office has no public education mandate. We do what 
we can, with almost no resources for the purpose, 
largely through the medium of this report, speeches and 
conferences as time permits, and of course the 
attentions of the media. 


None of these factors is to be discounted, particularly 
the last. Yet much more can and should be done. 
Forgotten, perhaps, is the government's commitment in 
1987 to seek a Privacy Act amendment to give the 
office an education mandate. Let us hope this reminder 
stimulates action. 


Over the years, both the incumbent and previous 
commissioners have discussed the merits or otherwise 
of extending the reach of the Privacy Act to include 
federally-regulated private businesses such as banks 
and transportation companies. In the case of the 
present Commissioner, this option was regarded not as 
the best thing to be done, but as possibly the only thing 
that could be done in the face of apparent failure to 
obtain good privacy protection in the private sector any 
other way. The urgency of this question is somewhat 
diluted by the current examination by Parliament of the 
privacy problems posed by financial and 
telecommunications legislation. Ve must await results 
to determine whether this case-by-case approach Is 
better. But there are distinct advantages in the sectoral 
approach made possible by the Bank Act, in which 


privacy rules for specific industries or services could be 
developed. This approach is now being adopted in the 
Netherlands. In the case of Canadian banks, both the 
Canadian Bankers Association and several of its 
members already have developed privacy codes which 
with some improvements and modifications, could well 
form the basis of a set of regulations governing their 
handling of personal information. The principal element 
missing from the codes as they now stand is a system 
of independent oversight and dispute resolution, which 
the Commissioner feels is essential to ensure 
compliance and public confidence. In any event, efforts 
to produce a more alert and informed body politic is a 
more urgent priority. An informed public is the best 
defence against abuse. That holds true for privacy as 
much as it does for democracy as a whole. It is 
certainly a pre-requisite to any kind of effective defence. 


Charter privacy protection 


The value of an aware public must also be considered in 
the context of a nation which still has no constitutional 
right to privacy. Although there are various laws such 
as the federal Privacy Act, which give citizens some 
protection in specific areas of information gathering, 
and although the Supreme Court has defined a privacy 
right in some cases—principally involving criminal 
laws—the acceptance of privacy as a basic human right 
has not yet found its way into our statutes. 


This office has sought to correct this oversight by 
appearing before the Special Joint Committee on a 
Renewed Canada to urge that a right to privacy be 
included among its recommendations. 


The submission pointed out that a privacy right was 
included in almost the very first draft proposed by the 
federal government when it unveiled its Charter of 
Rights and Freedoms, that it is already included in a 
number of similar documents such as the Guebec 
Charter of Rights, the Universal Declaration of Human 
Rights, the European Covenant of Human Rights, and 
the constitutions of several states of the American 
union, to name just a few. Moreover, the proposal has 
already been favorably viewed by the Commons justice 
committee (in 1987), and had the support of such 
important Canadian groups as the Canadian Bar 
Association. 


Unfortunately, the proposal did not command majority 
support of the committee. Although this office of 
course was not privy to the committee's in camera 
deliberations, we understand some members expressed 
concern that inclusion of a privacy right might have an 
adverse impact on other freedoms or rights, such as 
speech or access to information. It should be pointed 
out that a privacy right would be subjected to the same 
test of balancing the private and public well-being that 
applies to all rights and freedoms now in the Charter. 
The Charter expressly directs that these rights are to 
be exercised in a manner that is reasonable in a free 
and democratic society, thereby imposing on the courts 
the duty to seek a balance between competing or 
conflicting claims. 


The fate of this initiative was particularly disappointing in 
view of the constitutional exhaustion that is likely to 
ensue when the current round of negotiations 
concludes, with the dim prospect of re-opening the 
Charter any time soon. All the same, this is unfinished 
business on the Commissioner’s agenda, and the office 
will continue to press the case. 


Privacy in banking and telecommunications 


At the federal level, some kind of Great Divide may have 
been traversed, with the inclusion of language in two 
important pieces of legislation which makes it possible 
to accommodate privacy concerns. The first of these is 
the revised Bank Act and associated statutes, which will 
make possible the cross-ownership of banks, insurance 
and trust companies. Given the huge holdings of 
personal information in financial institutions, this office 
naturally is concerned by the degree to which these 
data might be shared in future, and to what extent the 
consent and control by clients and customers will be 
involved in the process. 


The legislation gives the government authority to make 
regulations covering such personal information 
exchanges. In April, the Commissioner appeared before 
the Senate banking committee to urge that Parliament 
take advantage of this authority and draft such 
regulations. 


The committee evinced considerable degree of interest 
in this recommendation, and indicated that the 
Commissioner might be invited to discuss the subject 
further. At the same time, the Commissioner 
understands the Department of Finance is also 
examining the issue. 


A telecommunications bill now before Parliament is even 
more explicit in recognizing protection of privacy as one 
of its objectives, the first such example known to the 
Privacy Commissioner apart from the Privacy Act itself. 
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As of this writing, the outcome of these initiatives is still 
to be determined. However, the Commissioner must 
record his satisfaction with this evidence of growing 
understanding of the privacy issue both in the councils 
of government and in the federal bureaucracy. 


In fact, the Commissioner sees in the above 
developments a possible answer, or the beginnings of an 
answer, to the oft-debated issue of regulating 
information practices in the private sector. 

Also on the legislative front, the Commissioner notes 
with great satisfaction the proclamation of 
Saskatchewan's Freedom of Information and Protection 
of Privacy Act and the intention of the government of 
British Columbia to proceed with the introduction of 
similar legislation. B.C. has engaged the services of 
Professor F. Murray Rankin as principal consultant, 
thereby ensuring the process will be favored with both 
enormous commitment and immense knowledge. 


The extension of privacy protection to Canada’s third 
most populous province means that more than 60 per 
cent of Canadians would enjoy the benefits of privacy 
oversight at the provincial level (joint Quebec and 
Ontario). The Commissioner is pleased to report that 
he has had consultations with officials of one other 
province now considering similar legislation. 


All these developments must be regarded in a highly 
positive light. They constitute hard evidence that 
governments more and more are recognizing privacy 
not only as a right to which all citizens are entitled, but 
one which in the face of increasingly intrusive technology 
needs to be supported by its own set of laws and 
regulations. 
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The Private Sector: Voluntary Action 


As previously mentioned, much of the Canadian banking 
industry now is covered by voluntary privacy codes. 
Following the promulgation of a model code by the 
Canadian Bankers Association, a number of the largest 
chartered banks have developed their own individual 
codes. While these codes differ in detail, and while they - 
fall short of what the Commissioner would consider 
ideal, they share one important characteristic—the 
recognition that clients and customers have a vested 
interest in the fate of the personal information which 
they provide to the banks, and are entitled to some 
measure of consent and control. 


As of this writing, for reasons mentioned earlier, these 
encouraging if less-than-perfect measures may be 
overtaken by the revised Bank Act. Even so, they provide 
an important starting point in what should be a joint 
government-industry effort. If Bank Act revisions do not 
occur, the Commissioner remains convinced that while 
the banks are to be commended for the progress made 
so far, their codes will still need to be strengthened. 


Also heartening are signs of progress in the direct 
marketing field, which in recent years and as noted 
earlier has been the target of much public concern and 
complaint. The Commissioner commented previously 
and favorably upon a decision by the Canadian Direct 
Marketing Association to create a system by which 
Canadians could have their names removed from 
marketing lists held by the association’s member 
companies. The association continues to work on an 
expanded code. It is unpublished as of this writing, but 
it is the fervent hope of the Commissioner that it will 
enlarge significantly the role of consumers, at least to 
the extent that prior consent becomes a condition of 
inclusion on such marketing lists. 
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Another promising initiative was undertaken during the 
year by the Canadian Standards Association (CSA) an 
organization whose primary responsibility is to ensure 
the safety and reliability of products marketed in 
Canada. CSA is most familiar to Canadians from its 
logo on products which conform to industry standards. 


Shortly after the Commissioner's last annual report 
appeared with its news on the European draft privacy 
directives, the CSA contacted this office to offer a novel 
suggestion. CSA proposed formation of a committee to 
develop a model privacy code, one which would serve as 
a minimum national standard for private sector 
organizations handling personal information. 


The CSA is ideally placed to develop such a code. 

It is an independent service organization of business, 
industry, labour, academia and regulators. This new 
proposal is a natural extension of the organization's 
involvement in international technology standards and its 
interest in technology's impact on consumers, business 
and industry. 


A workable model code for the private sector would 
balance trade and business interests with consumers’ 
inherent right to privacy. It would also demonstrate 
Canadian industry's commitment to the privacy 
principles contained in the OECD guidelines—and thus 
respond to the EC’s requirement for “equivalent or 
adequate” protection. 


The CSA code’s committee (of which the office is a 
member) has drafted a proposal and has already 
received indications of interest and funding from AMEX, 
Readers’ Digest, Bell Canada, Equifax and the federal 
departments of Consumer and Corporate Affairs and 
Communications. 
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If necessary, CSA will hire an experienced consultant to 
conduct research and work with the committee to 
develop the code. Once consensus is reached, the code 
will serve as the foundation, to be supported by various 
technical standards. It will become the cornerstone of a 
national compliance framework to help different 
business sectors establish privacy codes suitable for 
their particular environments. 


The Commissioner strongly endorses CSA‘s approach 
and has committed the office’s support. Private sector 
organizations interested in workable privacy solutions 
might find CSA's approach just what they are looking for. 


Privacy At Work 


Privacy in the workplace is an issue of rising concern, 
highlighted by the decision during the year of two major 
companies (Toronto-Dominion Bank and Exxon Canada) 
to introduce drug testing programs. Previous studies 
by the Office of the Privacy Commissioner have stressed 
the very limited utility of drug testing programs, and 
have concluded that the results to be gained do not 
justify the intrusive methods required. Developments in 
the past year suggest that the time has come to 
consider means by which individual privacy rights can be 
accommodated in areas of industrial activity which have 
special safety or other problems. It is not the 
Commissioner's view that no case can ever be made for 
testing programs; it is decidedly his view that such 
programs must meet demonstrated tests of both need 
and effectiveness. 
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Fine-tuning the Act 


The Privacy Act has been part of the landscape for nine 
years, long enough for observers to form at least some 
interim judgments about its effectiveness. It is entitled 
to high marks. 


The doctrine of fair information practices which is the 
heart of the Privacy Act has proved highly adaptable to 
a wide variety of situations in a rapidly-changing 
environment, and gives every sign of long life 
expectancy. Certainly, a better set of principles has yet 
to be devised. 


The chief limitation of the Act is that it applies only to 
records in the custody of the Government of Canada 
and some of its agencies. Fair information practices 
have found their way into the laws of only a few other 
jurisdictions, and hardly at all into the private sector. 
So by far the largest part of personal information 
holdings in Canada continues to be unprotected. 


Unless and until that situation changes, the Privacy Act 
will continue to be the most important piece of privacy 
legislation in the country, both for the immense holdings 
of personal information it covers in the Government of 
Canada, and for the benchmark against which data 
protection standards in other areas can be measured. 


Thus, while the Act has weathered well, it needs to be 
constantly re-assessed, not in the sense of major 
overhaul but, if the phrase may be used, of “polishing 
the jewel”. One comprehensive parliamentary review 
took place in 1986-87, as required by subsection /5(1) 
of the Act. But six years of added experience suggest it 
may be time for another. 
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surprisingly though, we advise fine-tuning the Act’s 
strengths: the definition of personal information (section 
3), the fair information practices code (sections 4 to 8) 
and the access to personal records protocol (sections 
V2/to28);: 


Redefining “personal information” 


The Privacy Act architects could not have foreseen 
today’s new technologies when they defined personal 
information. Advances in the science of genetics, for 
example, give added meaning to the words “information 
about an identifiable individual recorded in any form” 
(section 8—definition of personal information). 


Locked in the smallest drop of body fluid or speck of 
tissue is a mountain of information that defines in 
minute detail the characteristics not only of individuals 
but also those of their forbears. Though paragraphs 
3(b) and 3(d) refer to medical information and blood 
type, it is not clear that information recorded in 
biological samples about an identifiable individual falls 
within the scope of section 3. While it is clear the office 
would argue it does, any controversy regarding its 
inclusion could be eliminated by amending section 3. 
What is sought here is a clear statement that 
information contained in a genetic sample is personal 
information for purposes of the Act. 


some may argue that such an amendment is 
unnecessary tampering with an already elegant 
definition. But the genetic key is potentially so damaging 
to our privacy that a specific reference in the Act is 
needed. 
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Tightening up disclosures 


Sections 7 and 8 of the Act are the foundation upon 
which are built our confidentiality rights. Its cornerstone 
is the principle of informed consent. Personal 
information cannot be used or disclosed without the 
concerned individual's knowledge and consent. 


The Privacy Act demonstrates the truism that rules 
often need exceptions. Exceptions are necessary to 
strike a balance between an individual's right to 
confidentiality and the government’s responsibility to 
manage the affairs of state. It is, for example, 
reasonable for personal information to be disclosed 
without consent to meet legal requirements or for 
criminal investigation purposes. 


Curiously, one of the strengths of the legislation is 
contained in one such exception—paragraph 8(2)(m), 
disclosures in the public interest. The Act does not 
prevent public interest disclosures nor does it attempt 
to substitute detailed written rules for the reasoned and 
considered judgment of the head of an institution. 

It simply provides a transparent framework which 
ensures all interested parties are informed and that 
discretion regarding disclosure is properly exercised. 
The head of the institution who, after all, knows the 
records best, must balance the benefit to the public 
against the harm it may cause the individual. 
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However, most disclosures without consent do not 
require the head to exercise discretion. This may be 
delegated to staff. In this respect, the section is 
deficient. Staff should not be delegated the 
responsibility for consistent use disclosures; exchanges 
of information with foreign states or with the provinces; 
disclosures to investigative bodies, to Members of 
Parliament, to researchers, to auditors or to ; 
associations of aboriginal people. Since they are serious 
derogations from the prior consent principle, the head 
of the institutions should be required to decide on these 
disclosures. 


This process might also resolve another difficulty with 
consistent use disclosures. Subsection 9(1) requires 
government agencies to notify the Privacy Commissioner 
of new consistent uses not recorded in /nfo Source—the 
personal information index. The office has received and 
assessed only 18 such notifications in its entire history. 
Qur complaint and audit experience shows clearly that 
new consistent use disclosures are happening routinely 
without proper notification of the Commissioner. Surely 
higher level accountability would produce a more diligent 
application of all of the Act’s requirements. 


The Commissioner would welcome some fine-tuning of 
sections 7 and 8. The major flaw in the fair information 
practices code is its failure to provide a mechanism for 
an individual to prevent the release of personal 
information pending a determination of the propriety of 
its release. As previous annual reports have stated, it 
iS an anomaly that individuals denied access to their 
personal information may go to court for review of the 
decision, but they cannot seek a review of a 
department's decision to disclose their personal 
information to third parties. 
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The Access to Information Act provides a mechanism 
for alerting third parties, such as corporations, whose 
sensitive commercial information may be shared. Yet, 
the Privacy Act provides no similar rights to individuals 
whose sensitive personal information may be disclosed. 
Does not personal information deserve protection from 
abuse that is at least the equal of that afforded 
corporate information? | 


True, in matters of national security or criminal 
investigations it may not be possible, or wise, to provide 
an individual with prior notice before disclosing sensitive 
personal information. These disclosures can be properly 
documented for the Privacy Commissioner's review. 


Broadening the injury test 


While the Privacy Act gives Canadians an impressive 
array of access rights, it also gives government 
institutions a vast—cynics might say limitless—arsenal 
of exempting provisions to defeat them. These 
exemptions are not unreasonable if they can be 
supported by clear, strong rationale. Most of them are. 
Who, for example, would want terrorists to learn that 
law enforcement agencies were hot on their trail, simply 
by applying for their records? 


But some exemptions go too far. For example, 
government agencies can or must withhold personal 
information under sections 19, 22(1){a) and 22(2) 
without demonstrating that release would cause some 
injury. These provisions concern, respectively, 
information obtained from other governments, law 
enforcement information, and information obtained by 
the RCMP while providing policing services to a province 
or municipality. Solicitor-client information (section 27) 
can also be withheld without a requirement to 
demonstrate that its disclosure would be harmful. 
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However, paragraph 22(1)(a) is certainly the most 
offensive. This section authorizes the government to 
deny access to personal information prepared “in the 
course of lawful investigations pertaining to the 
enforcement of any law of Canada or a province”, 
provided the investigation was conducted by an 
“Investigative body”. There are nine such bodies listed in 
regulations to the Privacy Act. The exemption amounts 
to carte blanche to these bodies to deny Canadians 
access to their information for no reason whatever. 

No agency should be entitled to this kind of denial. 


Generally this section has not been abused. The RCMP 
for example, which has the right to use the exemption, 
rarely invokes it, preferring to use other sections of the 
Act. On the other hand, some cases demonstrate 
clearly how it can be misapplied. 


One example concerned the Department of Consumer 
and Corporate Affairs (CCA). CCA's director of 
investigation and research investigated a complaint that 
the Parliamentary Press Gallery had violated federal 
competition rules when it denied an application for 
membership. CCAs investigation found no violation but, 
confronted with the complainant’s subsequent privacy 
request for the opinions of Press Gallery members 
about his application, the department refused, taking 
refuge in paragraph 22(1)(a). Since CCA's investigation 
was complete, the Privacy Commissioner could find no 
valid basis for CCA denying the privacy request. 
However, the department was unyielding, and, given the 
blanket authority conferred by the section, he could do 
nothing more. 
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This kind of blanket exemption should be stricken from 
the Act. It has proved unnecessary even in such 
sensitive areas as police investigations. As it stands, it 
merely provides a convenient shield for bureaucrats not 
wanting to be troubled by the tiresome need to justify 
their decision. The following paragraph (22(1)(b)), with 
its injury test, provides a reasonable framework to allow 
government institutions to effectively manage their 
programs. 


The scope of this exemption explains the Commissioner’s 
reluctance to applaud additions to the list of investigative 
bodies. During the year, the Commissioner learned that 
three new bodies were being considered. The quarrel is 
not with the particular bodies being considered but rather 
with the concept of any investigative bodies at all. Other 
exemptions—subject to an injury test—provide all the 
latitude needed. The Commissioner’s office is now part of 
a working group examining the exemption, its uses and 
some options for the future. 


“Catch 22” 


One final preoccupation about the Act needs addressing 
in this report. 


Section 16 allows an institution to refuse to either 
confirm or deny the existence of personal information. 
To most of us at least, other exemptions provide a more 
than sufficient limitation to the general right of access. 
Section 16, though, goes far beyond the mere refusal 
to provide access. 
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The doctrine of refusing to confirm or deny is ingrained in 
Canadian security and policing psyches, and it would 
seem that section 16 Is its statutory embodiment. As 
distasteful as the notion is in a free and democratic 
society, it may be necessary for us to tolerate its use in 
order to achieve a public good. But invoking this section 
with any exempting provision other than those concerned 
with security and policing (sections 21 and 22), would 
surely constitute an unacceptable encroachment on an 
already too highly encumbered and fragile right of access. 
The Act should be amended to limit this authority to 
national security and criminal investigations. 


The threat to our privacy rights is compounded because 
though the Privacy Commissioner may investigate 
complaints about this section, he cannot reveal any 
information or even that there is no information! 


Should the Privacy Commissioner be unable to resolve 
the complaint, he faces Catch 22. Simply by referring 
the matter to Federal Court he runs the risk of revealing 
the existence of information, thus breaching his own 
Act. The Act needs a mechanism to enable the 
Commissioner to refer these complaints to the Courts 
for adjudication. 
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Genetic Testing 


it is easy to overlook the privacy implications of 
technologies many of us do not yet fully understand. 
Nowhere does this pose a greater danger than with 
genetic testing. 


Advances in genetic technology promise to unravel 
medical mysteries, thus preventing many diseases and 
allowing treatment of others. The technology can 
already identify many genetic traits or disorders and, 
occasionally, accurately predict our genetic destinies. 
This news is good. But there is also the inevitable dark 
side. Genes can reveal deep secrets about individuals’ 
physical and psychological being—secrets they may not 
want others to know, or may not want to know 
themselves. Stripping away the human being'’s very 
essence to the twisted strands of DNA molecules—the 
personal genetic building blocks — is an assault on 
privacy that few may want to endure. 


Do governments or other organizations have a right to 
acquire personal genetic information “for the public 
good’, with or without consent? Or should individuals be 
able to protect their genes from inspection by either the 
state or the private sector? 


This year the office completed its report, Genetic Testing 
and Privacy, the third in a trilogy on biomedical testing. 
(The first two dealt with HIV/AIDS and drug testing.) The 
latest report examines the issues flowing from the rapid 
development of genetic testing technology, including 
several present or potential uses. These tests could be 
designed to select genetically fit employees or monitor the 
effects of workplace hazards on their health; determine 
eligibility for such benefits or services as insurance: 
diagnose or predict medical conditions during regular 
medical care or reproduction (pre-conception, prenatal 
and neonatal), and provide more accurate forensic 
evidence in criminal investigations. 
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To date, genetic testing in Canada appears to have been 
limited to three fields — reproductive technology, 
regular medical care, and criminal investigations. Still, 
the advent of cheaper, more informative tests will 
almost certainly stimulate further interest in testing. 
Governments will not be the only intruders. Private 
sector interests, such as employers and insurers, will 
become increasingly enthusiastic about the supposed 
ability of genetic testing to give them a competitive 
edge. 


Governments may be tempted to override serious 
ethical concerns and apply genetic knowledge to 
promote eugenics. Certainly today’s world is not free 
from pressures to thus create “better societies”. In the 
private sector, genetics could be used to identify 
genetically “inferior” individuals. For these unfortunate 
members of the genetic “underclass”, access to 
employment or services could be severely impaired. 


In both environments—government and private sector— 
people could find genetic traits over which they have no 
control determining how they will be permitted to lead 
their lives, with little concern shown for the person 
behind the genes. 


This office was chilled by the potential growth in the 
number and types of intrusions that may ensue as 
genetic technology advances. Accordingly, the report 
recommends against mandatory (and, in some cases, 
voluntary) genetic testing in several situations. It also 
calls on the federal government to study the extent of 
genetic testing in Canada, and the likely future uses of 
this technology. 
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Prominent recommendations of the report are: 
° every person should have a reasonable expectation 
of genetic privacy; 


¢ governments should collect personal genetic 
information only if specific statutory authority 
permits; 


¢ neither government nor the private sector should 
compel persons to learn their genetic traits or 
disorders: 


¢ employers should not require genetic testing in 
employment, whether to identify undesirable genetic 
traits in employees or applicants, or to identify 
genetic changes due to workplace exposures: only 
true voluntary testing would be allowed: 


* service or benefit providers should not be 
permitted to use mandatory genetic testing to 
determine a person’s eligibility for services or 
benefits; 


¢ governments should not collect personal genetic 
information relating to the reproductive process: 


¢ governments should not collect personal genetic 
information relating to ordinary medical care: 


* governments should restrict forensic DNA analysis 
in criminal investigations to identifying offenders or 
exonerating suspects; 


¢ governments should not establish personally 
identifiable genetic databases or banks of genetic 
materials from the general population for crime 
control. 
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The report merely scratches the surface of genetic 
testing. The Commissioner hopes it will stimulate 
thought and action before powerful public or private 
sector interests transform us all from human beings 
into the mere sum of our genetic parts. 
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A Year in the Privacy Trenches 


Telecommunications toys—playing with privacy 


Readers of these reports may recall the former Privacy 
Commissioner's concern about the privacy threats in 
new telecommunications technology (1989-90 report, 
p. 26). The Commissioner cited Bell Canada’s new Call 
Management Services (CMS)—and Caller ID in 
particular. The CRTC has since approved Bell Canada’s 
service and similar ones are now available from most 
telephone companies. 


Caller ID is just one element of the new telephone 
technology. Many new phone services are not features 
of improved telephone sets but the product of powerful 
computers which handle telephone switching 
operations. However, users do need specially equipped 
telephones to allow them to see and record the caller’s 
phone number before picking up the handset. 


Seeing the caller's number before answering may 
provide protection against harassing calls. But it also 
trades away the rights of others who have an equally 
legitimate desire to avoid having their phone number 
known or recorded. 


This desire—or need—for anonymity is obvious for those 
Calling crisis hot lines or for volunteers who often return 
calls from home. Many professionals—from 
psychiatrists to probation officers, from politicians to 
undercover police officers—may now be unable to call 
from home, not wanting their numbers displayed and 
recorded. 


2/7 


Many are also concerned about commercial use of their 
phone numbers. Anyone calling a business with a 
Casual inquiry now courts the risk of having their 
number recorded, only to be called back for marketing 
purposes. Reverse directories (which list subscribers 
sequentially by phone number) can then link the number 
to a person and address. 


Trading away everone’s privacy is a heavy cost for CMS’ 
few benefits. Charging subscribers to prevent the 
display of their numbers means privacy is for sale and 
not everyone will be able to afford tt. 


These concerns are well-founded and workable solutions 
are elusive. CMS can vary from one phone company to 
another, making privacy protections a patchwork. Some 
companies allow callers to block the number display for 
all calls on their line—or just selected calls—but at a 
cost. Some charge nothing to block. Others offer a 
form of encryption which scrambles the number. Nearly 
all companies offer a solution for women’s shelters. 


One recent CMS decision comes from the Manitoba 
Public Utilities Board. The board approved Manitoba 
Telephone System's application for a trial run, providing 
that all subscribers benefitted from free call blocking. 
The board also demanded free line blocking for shelters 
and individual victims of abuse. However, the board did 
not approve Call Return—the option which traps the 
numbers of unanswered incoming calls and displays 
them later on command. 


Of broader significance is the CRIC's recent 
announcement-well after the end of our reporting year— 
that phone companies under its jurisdiction must offer 
free per-call blocking. 
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Canada is not alone in its struggle to find appropriate 
solutions for technological advances. In the United 
States, the debate has raged since New Jersey 
introduced the service in 1987—a debate involving 
public utility commissions, state and federal legislatures 
and even the courts. 


And the solutions range from New Jersey's, which 
offers no blocking at all, to Pennsylvania where CMS has 
been ruled illegal since it offends the state wiretap law. 


Texas proposes that customers pay if they want to 
display and, most recently, an administrative law judge 
in California proposed that the state utilities commission 
prohibit Caller ID because it is not in the public interest 
and violates both the state and federal constitutional 
right to privacy. 


Still other states offer free per-call blocking, pay-per-line, 
free per-call and per-line blocking. At the height of the 
debate, one company even offered a service to 
automatically refuse blocked calls. The options are 
dizzying. 


The debate has focussed public attention on the privacy 
issue. Probably more disturbing is the knowledge that 
these services are only the beginning—an early feature 
of the ever-increasing intelligent network system. This 
system will soon offer personal communication networks 
with a lifetime personal phone number, dial-up services 
and picturephones. The technology is evolving so fast 
that neither engineers nor policy makers have time to 
consider the social impacts. Each new development 
affects or overrides the privacy protections so 
laboriously erected to defend against the last one. 


abe 


Obviously the Privacy Commissioner's small office cannot 
keep abreast of each new technical marvel; it lacks the 
expertise and resources. Nevertheless, the 
Commissioner is eager to find enduring and workable 
solutions. 


The New York State approach has substantial appeal. 
That state’s public service commission took a broad 
policy approach to telecommunications privacy, 
approving eight privacy principles. They state, for 
example, that telecommunications companies should 
recognize clients’ privacy explicitly and that customers 
should not pay extra to preserve their privacy status 
quo. Customers should be told of any proposed use of 
their information and be able to give informed consent 
to any further uses. 


The office and the Department of Communications are 
both examining the broad issue of telecommunications 
impact on privacy and considering some remedies. 


New Telecommunications Act 


A step in the right direction may be the initiative in the 
proposed Jelecommunications Act in which Parliament 
recognizes the privacy impact in telecommunications 
technology. The act includes as a policy objective 


“ ...t0 respond to the economic and social 
requirements of users of telecommunications 
services, including the protection of the privacy of 
individuals. ...” 


This act also allows the government and the CRIC to 
block such intrusions as unsolicited phone calls and junk 
faxes. 
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The office intends to monitor passage of this bill through 
the House to help ensure that the privacy protections 
are not eroded. At issue is whether its provisions go far 
enough. Either the act or its regulations should outline 
the privacy standards which telecommunications 
services must meet. 


This year’s SINs 
Born without SIN 


Resistance to demands for the Social Insurance 
Number (SIN) took an unusual turn this year when a 
Prince Edward Island couple refused to apply for a SIN 
for their newborn baby. 


PEl's vital statistics department requires all newborns to 
be assigned a SIN for the province to use as 
identification numbers for its Health Service Payment 
Plan. The couple asked for an exemption and were 
denied. The health department responded by refusing 
all claims for the baby’s medical care because she did 
not have a SIN. 


The couple has taken the case to court, arguing that 
requiring the baby to have a SIN (and denying the 
medical claims) offends several provisions of the 
Canadian Charter of Rights and Freedoms. The parents 
maintain that their daughter has no legal obligation to 
obtain a SIN until she begins insurable employment. 
They argue further that denying the medical claims 
offends Charter protections against unreasonable 
search and seizure and denies the baby’s right to equal 
benefit of the law, and requiring a baby to have a SIN 
breaches an individual's reasonable expectation of 
privacy. 
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The case is interesting to this office, although well 
outside the Privacy Act. But it does raise an important 
privacy question: what program or activity of 
Employment and Immigration Canada (the department 
responsible for issuing SINs) allows it to issue the 
numbers to newborns? 


SINs were created for unemployment insurance and 
Canada Pension Plan, and later authorized for use by 
Revenue Canada for individual income tax reporting. 
Recent federal government policy—applauded by the 
Privacy Commissioner—has reined in many unrelated 
federal government uses of the numbers. However, 
apparently EIC still relies on a 1970 federal-provincial 
agreement concluded well before any federal privacy 
protection was in place. 


The Commissioner has asked Employment and 
Immigration to identify a direct relationship between 
assigning SINs for birth registration and EIC programs. 
If none can be shown, he will urge EIC to reconsider its 
arrangement with PEI in light of both the Privacy Act 
and the federal government's policy to restrict SIN use 
to a short list of social programs. 


Casting the first stone— 
renumbering the public service 


One significant impact of the federal policy to restrict its 
own use of SIN is the need to re-number some 
310,000 public servants, members of the military and 
RCMP. 
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Supply and Services Canada (which controls the pay and 
records data bases) will begin assigning new Personal 
Record Identifiers (PINs) by January 1993. Each 
employee will receive two numbers: the PIN and a 
second number to be given to third parties such as 
banks, insurance companies and the employees’ unions. 
This second number will ensure that employees’ PINs 
remain private but allow the employer to link third party 
transactions to the correct employee. 


There remains some confusion about what constitutes a 
proper request for a person's SIN. For example, the 
Public Service Commission's language testing programs 
still ask employees to volunteer their SIN and public 
service unions continue to use SINs for membership 
purposes. These are legitimate requests. But once the 
renumbering is completed, the Commissioner urges 
federal employees to keep their new PIN to themselves. 


SIN or else 


The Commissioner's office was alerted to what seemed 
to be an unnecessary use of SIN in Employment and 
Immigration Canada’s new automated Job Information 
Bank in St. John’s, Newfoundland. The pilot project 
allowed job seekers to scan a computerized listing of 
available positions and select those that matched their 
interests and skills. The system gives applicants 
greater opportunity and frees up EIC staff for other 
duties. 


However, a caller complained that he could not even 
look at the list without first providing his SIN. Since any 
casual passer-by can scan the paper notices of jobs 
available, he thought demanding a SIN for a computer 
listing was excessive and—since he was not claiming 
unemployment insurance—unneccessary. 
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Apparently EIC asked for the SIN to measure both the 
effectiveness of the system and its ability to place Ul 
claimants. Responding to the office’s enquiries, EIC 
acknowledged that the system should also 
accommodate non-Ul claimants. 


The system has now been modified. The opening 
screen advises users that access to the system is 
unrestricted. Those receiving unemployment insurance 
have the option of entering their SINs so that the 
Canada Employment Centre has a record of their job 
search. This change will become part of the new 
nationwide job-bank system. 


Technology update 


Last year the Commissioner reported on Employment 
and Immigration Canada’s (EIC) plans to harness new 
information technology to handle the department's huge 
client load. EIC had pilot projects underway using smart 
cards and an automated telephone answering service 
(AVRES). 


EIC is not the only federal department considering using 
new information technology to improve service. 
Veterans’ Affairs has already tested smart cards as a 
method of improving its delivery and billing of 
prescription drugs to veterans. Revenue Canada is 
looking at the possibility of having travellers use the 
cards to declare goods or pay fees at customs points. 


several departments are jointly developing smart cards 
which would allow remote access to government 
computers. This would permit someone working at a 
home personal computer to communicate with a 
government agency's computer over the telephone. 
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As with much of the new communication technology, 
there are privacy implications. 


The smart card is like a conventional bank or credit 
card—but with an essential difference. Smart cards 
are imbedded with an integrated circuit chip which gives 
the card intelligence for processing and memory for 
storing data. Chips and digitized information also make 
it possible for the cards to carry an invisible photograph 
or even a fingerprint of the bearer. The cards could be 
used to provide banking, telephone and medical 
services, giving the user access to a network of 
computers. 


Privacy needs 


Clearly smart cards are an important technical advance 
which can improve service to clients and control costs 
for departments—particularly those like EIC which must 
track, credit deductions for and pay benefits to such 
large numbers. 


Yet government agencies and their clients should be 
able to enjoy the benefits of progress without sacrificing 
individuals’ control over their personal information. In 
effect smart cards could become that universal identity 
card that North Americans so fiercely resist. Their 
development invites a profound shift in the relationship 
between the individual and the state. 


This can be avoided, first, by making the systems 
transparent to the clients. Card bearers must know 
their inherent rights when using the card, what 
information the card contains, how it will be used, and 
what risks that use implies. 
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Individuals should be free to refuse the card without 
jeopardizing their access to the service. And similarly, 
holding a card should not confer advantages unavailable 
to those who opt out. 


Finally, the systems and their participants must respect 
both privacy laws and basic ethical principles on 
collection, handling and disclosure of personal data. 


Because of the Commissioner's concern about the 
security aspects of the pilot projects, his staff were 
invited to join two federal government working groups: 
one dealing with applications of the technology and the 
other developing standards for remote access to 
computer systems. 


The applications group—whose ultimate goal is to 
establish standards and guidelines for all government 
smart card applications—uwill identify how government 
might use the cards and the framework in which they 
should operate. Its membership includes such federal 
agencies as Health and Welfare Canada, Supply and 
services Canada, the RCMP and Veterans’ Affairs, as 
well as the Quebec and Ontario health ministries. 


The office is also a member of a special interest group 
working on the development of remote access to 
computer systems. Since many government agencies 
have a common interest in access, they are sharing 
research and development costs and contributing to 
shared standards. 
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The AVRES Project 


Last year’s report (p.53) described a privacy flaw in 
EICG’s automated telephone inquiry system being tested 
in Quebec City. The story ended unsatisfactorily since 
the project seemed too far advanced to change. 
However, EIC has re-written the ending and the 
Commissioner could not be more pleased. 


The system allowed claimants with touch-tone 
telephones to call into a computer for routine 
information about their own unemployment insurance 
claims. For example, a caller could confirm that his or 
her claim had been accepted and when benefits would 
begin. Callers identified themselves by their Social 
Insurance Number (SIN) and birthdate. The office heard 
about the service when a local radio station questioned 
this use of SIN. 


There was no question that EIC could use SINs to 
identify Ul claimants—the numbers were devised for this 
purpose. But the Commissioner was concerned about 
the lack of security of the SIN-birthdate combination. 
The office discussed the problem with EIC staff who 
agreed that both pieces of personal data are widely 
available and therefore not a secure access code. 
However, the test project had already expanded to 
London and Peterborough and it seemed too late for 
changes. 


Nevertheless, aware of the Commissioner’s concern, 
EIC systems designers used the Peterborough project to 
test a new four-digit telephone access code similar to a 
bank number. 


EY 


Apparently the test was successful and the new code 
will be a feature of the national program. EIC will assign 
claimants the number to identify themselves when 
making telephone inquiries. Claimants may also choose 
their own numbers. 


The Commissioner applauds EIC’s quick response and its 
sensitivity to client security. , 


Data Matching 


Probably the most important data matching news this 
year is what did not happen—apparently data matching 
did not happen. The Commissioner received just three 
notifications during the entire year—all from Agriculture 
Canada. 


The Commissioner wishes not to appear suspicious. Yet 
it would be credulous to accept that of more than 150 
federal agencies subject to the government's data 
matching policy, only one began any new matches of 
discrete sets of files during 1991-92. 


The matching policy restricts linkages between 
computer data bases that could produce detailed 
dossiers—or “super files” on individuals. It also requires 
federal agencies to submit matching proposals to the 
Commissioner 60 days in advance. He then assesses 
the match against a set of criteria and acts as an 
advocate for the subjects of the files. The intent is to 
prevent government efficiency from trampling individuals’ 
personal information rights. 
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The policy, while admirable, may not be working. 
Only 22 federal agencies describe anything remotely 
resembling a data match in their listings in Info 
Source—the federal information directory. Some 
departments couch matches under more benign 
headings like “use” or “disclosure”. And others only 
recognize a match when it links with data from an 
outside agency, contrary to the policy which also 
controls matches of different program files within an 
agency. 


Everything the Commissioner has seen leads him to 
conclude that computer data matching is common in 
government—particularly with social programs, law 
enforcement and intelligence operations and the 
criminal justice system. Do government staff recognize 
a data match? Are they unaware of the policy? Or do 
they simply see the policy as a nuisance to be avoided? 


The Commissioner urges the Treasury Board to 
investigate. In the meantime, the Commissioner’s 
compliance auditing teams have added data matches to 
their list of audit criteria. 


Agriculture Matches 


In fairness, Agriculture Canada has been scrupulous in 
observing the data matching policy. Its first notice 
advised that the new Farm Income Protection Act would 
allow Agriculture to match farmers’ information from 
the income stabilization account with income information 
from Revenue Canada. 


The match will ensure that the benefits farmers receive 
from these programs are based on correct information 
about their revenue, expenses and production. The act 
gives Agriculture legal authority for the match and 
allows it to use the Social Insurance Number. 
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Garnishees for Family Support: Agriculture also advised 
the Commissioner that it would match information from 
the Western Grain Stabilization Program with the 
Department of Justice to allow garnishee of program 
payments from farmers who had defaulted on their 
family support. In fact, the submission was 
unnecessary because Parliament had passed a 
regulation under the Family Orders Agreements 
Enforcement Assistance Act authorizing deductions 
from the stabilization program. 


More Information Needed: Finally, the Office was notified 
of a match between Farm Debt Review Board files and 
Quebec agriculture department records. The match 
supports a new program to subsidize beef feed lot 
operators and to mediate with farmers’ creditors. The 
Office has not received sufficient detail to assess this 
match. 
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Complaints Directorate 


The office received 1,402 new complaints this year 
compared with 1,239 last year—an increase of 13 per 
cent. This increase is consistent with the pattern 
established since the office opened in 1983. Not 
consistent is the drop in the number of completed 
cases—/82 cases were closed, 269 of which were 
well-founded, 448 not well-founded and 65 discontinued. 


The 1991 Census 


During the past year, one issue has consumed 
considerable time—investigating 34 complaints against 
the 1991 census. Several complainants were 
concerned about Statistics Canada's collection of 
personal information and had refused to respond to 
census questions they considered an unacceptable 
invasion of their privacy. 


Others cited the guarantee (or lack) of confidentiality of 
their census responses. The most frequent complaint 
was that census workers who gathered the results 
were neighbours or acquaintances of the complainants. 
Complainants believed that their completed 
questionnaires would be sent directly to Statistics 
Canada in Ottawa to be reviewed by some anonymous 
bureaucrat, not by someone from their neighbourhood. 
The investigation is now in its final stages and its results 
will soon be shared with Statistics Canada. 


This is the first time this office has undertaken such a 
complicated and time-consuming investigation, and it has 
taken its toll. The nearly six months spent by three senior 
privacy officers who spearheaded the investigation took 
time away from other cases. This is the main reason 
that the number of completed cases is lower than last 
year. Staff turnover (and subsequent training) has also 
contributed, thus exacerbating a growing backlog. 
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A New CPIC Policy 


The Canadian Police Information Centre (CPIC) continues 
to be the target of complaints and inquiries about the 
collection, use and disclosure of personal information 
held in its databases. CPIC is a collection of police 
databases, federally funded and administered by the 
RCMP. However, it is governed by an advisory 
committee of major municipal and provincial police 
forces who contribute and have access to the 
information. 


We often hear from individuals who cannot get access 
to their own information in CPIC because various police 
forces cannot disclose information contributed by 
others. For example, CPIC may not disclose personal 
information contributed to it by the Ottawa City Police. 


This office has discussed its concerns about CPIC’s 
administration in earlier reports and recommended that 
the RCMP consult other CPIC users about introducing 
voluntary privacy controls over its databases. This 
would provide comprehensive protection for CPIC’s 
collection, use and disclosure of personal information, 
and allow individuals to access and correct their 
personal data. 


Congratulations are in order. CPIC approved and 
implemented a CPIC Code of Ethics In November 1991, 
one which generally addresses the Commissioner's 
concerns—particularly those dealing with access rights. 
It entitles individuals to request access to their personal 
information maintained on CPIC and to correct it, when 
necessary. 
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Top Ten 


Last year, for the first time the office listed its top ten 
clients—a group which accounted for 8O per cent of the 
total caseload. Eight of those ten departments made 
the list again this year: Correctional Service Canada 
(CSC), Canada Post Corporation, Employment and 
Immigration Canada, Revenue Canada-Taxation, National 
Defence, Canadian Security Intelligence Service(CSIS), 
RCMP and National Archives. 


Joining the top ten is the Immigration and Refugee 
Board (IRB) with 68 complaints received—the first 
privacy complaints received against IRB. However, 67 
of those were made by one person, including 33 time 
limit complaints which were considered well-founded. 
Investigation of the 33 access complaints continues. 
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Another significant increase occurred at Revenue 
Canada-Customs and Excise. Their 72 complaints 
constitute a five-fold increase over last year’s figures. 


Last year’s report applauded CSC for its efforts to 
conquer its delay problem. Unfortunately CSC’s delay 
complaints more than tripled this year—160 (compared 
with SO last year). These delays account for 34 per 
cent of the year’s time limit complaints. However, this 
warrants an explanation. CSC has changed the way it 
processes information about inmates that it receives 
from provincial and municipal governments and police 
forces. CSC routinely used to exempt information 
received in confidence from another government. 
However, after years of urging from this office, CSC now 
asks the originator whether it will agree to disclose. 


This causes delays for applicants. With heavy caseload 
and shrinking resources, CSC has to choose between 
two evils: providing a less than complete response in 
time—or go the extra mile, risk exceeding the time 
limits but provide the applicant more information. 


Other departments also continue struggling to meet 
time limits: National Archives, Revenue Canada-Taxation 
and National Defence. 
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Toward the end of the reporting year, the office changed 
the way it reported time limits complaints. Frequently, 
complainants question departments’ claims of a time 
extension either to consult other organizations or 
because operational requirements prevent them from 
responding within 30 days. The office did not count the 
number of complaints specifically questioning the notice. 
But time limits complaints have now been divided into 
two categories: time limits and extension notices. The 
change acknowledges the distinction between the two 
issues. It also identifies departments which continue to 
neglect their responsibilities to respond in time. 


At a time of government restraint it is difficult to 
chastise departments for not respecting the time limits. 
Budgets and staff have been slashed in most 
government departments with the result that service to 
the public suffers. 


While the number of time limits and access complaints 
received increased by 31 per cent from 855 last year 
to 1118 in 91-92—the number of complaints about 
improper collection, use and disclosure dropped by 26 
per cent—from 384 in 90-91 to 284 in 91-92. 


How Institutions Measured Up 


The RCMP continues to carry the banner for 
maintaining its high regard for the letter and spirit of 
the Act. Only one of Its complaints was well-founded, 
resolved; 40 were not well-founded, while three were 
discontinued. CSIS too must be commended; of the 56 
complaints completed last year, only five were 
considered well-founded, and all were resolved. 
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Last year CSC had the highest ratio of well-founded 
complaints, with EIC, Taxation and DND not far behind. 
This year, despite continuing to head the list of 
complaints received (a total of 287), only 27 per cent of 
all CSC’s complaints were well-founded. Approximately 
one-half of the complaints against EIC and Taxation, and 
32 per cent against DND were well-founded. 


This year’s number of discontinued findings is high—65 
represents eight per cent of completed cases. 
However, the majority were discontinued when the 
office's initial notice to the departments prompted them 
to resolve the problem. Of course, that’s what the 
ombudsman's role is all about—resolving problems, not 
counting complaints. 


Top Ten Departments by Complaints Received 
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Proposals for New Exempt Banks 


The office was consulted twice during the year on 
proposals to create new exempt banks. The RCMP 
advised the Commissioner that it intended to seek 
Cabinet approval to create an exempt bank for its 
National Security Investigation Records. CSIS also 
notified the Commissioner of its proposal to seek an 
exempt bank for its Investigation Records. 


A staff review of both banks determined that they 
consist predominantly of personal information obtained 
or prepared during criminal investigations or whose 
release could damage the conduct of Canada’s 
international affairs or defence (sections 21 and 22 of 
the Privacy Act). The Commissioner would not 
comment personally on the validity of the exemptions in 
order to avoid any conflict of interest should he receive 
a complaint about information contained in the files. 


The Constant Plea for More Resources 


The 13 per cent increase in new complaints has put the 
office behind by almost a full year’s caseload—1 209 
cases pending at year end. As predicted in last year’s 
annual report, the backlog increased investigators’ 
workloads to 200 each. Thus clients are now kept 
waiting sometimes months longer than they should to 
receive the Commissioner's finding. 


Treasury Board allotted the office two additional person 
years to hire more privacy officers. But if new 
complaints continue to arrive at last year’s pace, the 
office faces the spectre of more than 2000 open 
cases. This risks becoming unmanageable. 
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Completed Complaints 1983-92 
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Complaints Completed by Grounds 1991-91 
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Completed Complaints by Department and Result 
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Some Cases 
CPIC limits AIDS identifiers 


A group of community organizations in Vancouver asked 
the Privacy Commissioner to look into allegations that 
Canadian Police Information Centre (CPIC) databases 
identified individuals as HIV positive. 


Although no one could point the finger at a specific 
incident—and the office's jurisdiction over CPIC is 
questionable—the Commissioner decided to inquire 
informally. 


The RCMP (which administers CPIC) explained that 
individual CPIC files could contain a “C’ flag to indicate 
that the person has a contagious disease. The flag 
helps police find individuals with communicable diseases 
who have escaped from penitentiaries or wandered 
away from hospitals. It also helps police inform those 
who may have been exposed to disease. 


The CPIC advisory committee asked for a legal opinion 
on identifying HIV/AIDS carriers. As a result, CPIC 
policy now forbids identification of carriers unless they 
have threatened to transmit the condition using physical 
violence or, for example, if a carrier has violated the 
public health act by willfully spreading the virus. 


CPIC contacted all CPIC users to explain the new policy 
and a subsequent audit identified 96 °C” entries (not 
necessarily HIV/AIDS). Since then CPIC has reminded 
users and done yet another audit which found fewer 
than 40 “C’ files remaining—all for bona fide law 
enforcement reasons. 
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Finally, an RCMP member and the privacy investigator 
met the coalition members in Vancouver to brief them 
and answer questions. The coalition appeared satisfied 
with the outcome. The Commissioner is particularly 
grateful that CPIC and the RCMP were willing to listen 
and respond to the group’s real concerns. 


Respondent should see entire file 


A complaint about the Public Service Commission’s 
handling of an application to see a personal harassment 
investigation file revealed what seemed to be 
inconsistent treatment. 


The applicant (the respondent in the harassment case) 
was given only those parts of the file that PSC 
considered his personal information. The investigation 
revealed that PSC processes harassment files 
differently, depending on who is the applicant. When the 
applicant is also the complainant, PSC considers the 
entire file that individual's personal information and 
discloses everything except that which may be exempted 
under the Privacy Act. 


However, when the applicant is someone else—for 
example, witnesses or the respondent—PSC processes 
only those records considered to be the applicant’s 
personal information. 


The privacy investigator considered that since the 
applicant was also the alleged harasser and lone 
respondent—and the entire file dealt with the 
investigation of a complaint against him—PSC should 
process the entire file. 
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PSC officials have agreed that when the respondent is 
an individual (rather than the department), It will 
process privacy applications from both complainants 
and respondents in the same way. This means that all 
information on the PSC investigation file will be disclosed 
unless it may be exempted under other provisions. 


Since the applicant had not been denied access to any © 
of his own personal information, his complaint was not 
well-founded. However, his complaint prompted PSC to 
disclose the remainder of the file which did not qualify 
for exemption and to change its processing 
methodology. 


New spouses get equal treatment 


An employee of the Communications Security 
Establishment (CSE) told his supervisors of his pending 
marriage, a requirement of all federal employees holding 
a secret or top secret security clearance. The 
employee provided his bride’s name, birthdate, address 
and name of present employer—as required by the 
government's Personnel Security Clearance 
Questionnaire. 


However, CSE also requested details of the new 
spouse’s residence and employment from the previous 
five years. At that point, the woman complained to the 
Privacy Commissioner that CSE’s demands for more 
information invaded her privacy. She also held that CSE 
should have asked her directly for the information and 
not collect it from a third party. 
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The investigation revealed that CSE’s policy on security 
reliability checks was inconsistent with most other 
federal government departments which rely on the 
information on the employee's security questionnaire. 
As well, new CSE employees are not required to provide 
the more detailed information about spouses. Only 
established employees who change their marital status 
must provide their new mate’s residence and 
employment history. 


DND was the only other department found to demand 
this supplementary information in similar 
circumstances, asking for details of residence and 
employment over the previous ten years. 


Without question, details of relatives’ personal history is 
needed to conduct background checks on those in a 
position to influence employees with access to national 
security secrets. However, It was difficult to understand 
why CSE needed more personal history of new mates of 
its established employees than of spouses of new 
employees. 


CSE officials were persuaded to bring their policy in line 
with other departments. Ironically, before the 
Commissioner's office pursued the matter with DND, its 
policy had already been amended. 


The complaint was well-founded but resolved. 
Bulletin boards no place for grievance responses 


A National Defence employee complained to the 
Commissioner that his supervisor had posted on a 
bulletin board DND's response to his formal grievance 
about smoking in the workplace. The department's 
letter included his name, address and comments on 
DND's policing of its anti-smoking policy. 
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The investigation found that indeed the letter had been 
posted in the room where the complainant worked, in 
full view of other civilian and military employees. 
Apparently a manager had told the man’s supervisor to 
post the letter as a reminder to personnel to comply 
with the anti-smoking policy. 


Following the investigation, DND agreed that the 
personal letter should never have been the mechanism 
for reminding employees not to smoke in DND buildings. 
DND has ensured this will not happen again. 


The Commissioner considered the complaint well- 
founded. 


Employees’ personal papers not for disclosure 


During its investigation of a harassment complaint 
Revenue Canada-Customs searched the office of an 
employee it suspected of writing an anonymous note 
found on a colleague’s desk. Revenue Canada 
investigators photocopied the employee's personal 
phone directory and took documents from his personal 
files to have analyzed by handwriting experts. 


Discovering this, the employee complained to the 
Privacy Commissioner that Revenue Canada had 
improperly disclosed his personal information. The 
Commissioner’s investigation established that personal 
documents had been taken; used during the 
harassment investigation, and disclosed outside the 
department without the complainant's consent. 
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The documents included employee benefit statements— 
including some medical information—and his completed 
personal record form which lists education, previous 
employment, personal references and identifies family 
members, their occupations and addresses. The 
Commissioner concluded that the use of this type of 
personal documentation during an internal investigation 
could hardly be “consistent” with the original collection 
purpose. He considered the complaint well-founded. 


Revenue Canada-Customs has apologized to the 
complainant for disclosing the documents and has 
amended its investigation manual to prevent 
investigators from using such personal information 
without the individual’s consent. 


Anonymous tipster not EIC 


A complainant alleged that Employment and Immigration 
Canada (EIC) had disclosed to his ex-wife information 
about his earnings from his unemployment insurance 
file. She then used this information in a court 
application to increase his support payments. 


The investigator interviewed the two EIC employees who 
dealt with the complainant, both of whom denied 
disclosing any of his personal information to any 
unauthorized persons. The ex-wife and her current 
husband were also interviewed. They too denied having 
obtained the information from EIC, saying that the tip-off 
came from an anonymous caller. 


The Commissioner concluded that there was no 
evidence to support the man’s allegation that EIC staff 
were the source of the information and he dismissed 
the complaint. 
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Complainant revealed identity himself 


A man complained to the Commissioner that 
Employment and Immigration Canada (EIC) officials had 
identified him to an ElC-funded organization as the 
applicant seeking information about it under the Access 
to Information Act. The complainant correctly observed 
that identifying him as the applicant was an improper 
disclosure of personal information. 


The investigation established that the complainant had 
had a dispute with the managers of the organization 
which provides on-the-job training to otherwise 
unemployable individuals. The complainant then made 
annual access requests to EIC for information about the 
organization. He was well known to its staff and Is 
alleged to have spoken openly about his requests for the 
centre’s records. 


When the latest request arrived, the manager simply 
assumed it was from the same person. As he said: “It 
didn't take a rocket-scientist to figure it out’. 


Without evidence to support the allegation that EIC 
revealed the source, the Commissioner concluded that 
the complaint was not well-founded. 


Can mail blind persons’ audio tapes “sealed” 


A blind person complained that Canada Post's 
requirement that letter and talking book tapes be mailed 
unsealed violated his privacy rights. 


The investigator found that blind persons can mail audio 
tapes free of charge. However, the material must be 
packaged so that Canada Post personnel can open it 
easily to ensure that it meets the regulations. 
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The complainant agreed to have the investigator discuss 
the matter with the Canadian National Institute for the 
Blind (CNIB). CNIB explained during the meeting that its 
free postage privilege amounts to an almost $3 million a 
year subsidy, which CNIB is reluctant to jeopardize. 


Cassette tapes must be sent in special padded mailers. 
For talking books (the bulk of its mailings) CNIB has 
developed a re-usable plastic pouch with a Velcro 
closure. According to CNIB, this is as much for 
convenience as for ease of inspection. For other 
mailings, small padded envelopes are used and are 
either taped or stapled shut. Canada Post does not 
object to taping or stapling and the CNIB had never 
heard of a blind person being challenged on this type of 
closure. 


CNIB pointed out that the regulations require that the 
closure permit easy inspection of the contents. It does 
not forbid sealing the envelopes. He suggested that the 
complainant simply staple his envelopes shut so that it 
would be relatively easy to tell if the envelope had been 
opened. 


CNIB illustrated Canada Post's flexibility on the use of 
the free mailing privilege with anecdotes of blind 
individuals mailing back their cassette players to CNIB 
for repairs, claiming (and receiving) the free mailing 
privilege. According to CNIB, these mailings are 
definitely not covered by this privilege. 


The investigator explained the entire procedure, as well 
as the CNIB’s position, to the complainant. He was 
Satisfied that Canada Post was not unnecessarily 
violating his privacy rights. The Commissioner concluded 
that the complaint was not well-founded. 
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Disclosure an error—but whose? 


A complaint against the RCMP illustrated that 
sometimes it is impossible to get to the root a problem. 


A man complained to the Commissioner when he 
learned that the RCMP had sent an unsolicited copy of 
his fingerprints and criminal records to Canada Post. 
There was no apparent reason for this disclosure since 
the man had received a pardon for his conviction. The 
records should have been sealed. 


The investigator was unable to get a satisfactory 
explanation—audit trails were unclear and eventually the 
Privacy Commissioner's decision had to be based on 
“best available” information. 


The investigation showed that in early 1991, Canada 
Post security received a copy of the complainant's 
criminal history record from the RCMP. Although this is 
normal procedure when its employees or candidates 
undergo security screening, security staff had no record 
of requesting the information. The complainant was not 
a employee, nor was he an applicant for a position. The 
record was put in a “pending: file. 


At the investigator’s request, the RCMP examined its 
records and found the distribution notation “Post Office, 
Ottawa” next to the man’s criminal conviction listing. 
However, this did not explain why it had sent an 
apparently unsolicited copy of the record to Canada 
Post. 
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Further inquiries showed that the man had been briefly 
employed by Canada Post more than 10 years before. 
A reliability check (including fingerprinting) was done at 
that time. This explained the original distribution 
reference to the post office. Once he left the position, 
his personnel records—including his fingerprints—would 
normally have been transferred to the National 
Personnel Records Centre. 


The complainant, once again a federal government 
employee, recently underwent a periodic review of his 
security clearance. This required the RCMP to process 
his criminal history record. Since no-one had removed 
the distribution notation on the old record, the updated 
record was sent to Canada Post. 


This explanation is largely a reconstruction of events 
based on probabilities; it is not definitive. The Privacy 
Commissioner concluded that there had been an 
improper distribution of the information but, given the 
lack of detail, he could not say who was responsible. 


However, he was able to reassure the man that Canada 
Post no longer possessed either the fingerprints or 
criminal history record and that the information had 
been well-protected for the brief period it was in Canada 
Post hands. The RCMP no longer has the fingerprints. 


Denial “legal” but unnecessary 


An Ottawa man asked the Commissioner to investigate 
his complaints against Consumer and Corporate Affairs 
(CCA), including one that alleged it had improperly 
denied him access to his personal information. He had 
lodged a complaint with CCA under the Competition Act 
and, unhappy with the investigation, wanted to see the 
comments about him in the file. 
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The Commissioner's investigation confirmed that CCA 
had withheld some information collected by its Director 
of Investigation and Research (DIR), claiming that it had 
been collected during a lawful investigation. Since the 
directorate is one of those units identified as 
“investigative bodies” in the Privacy Act, paragraph 
22(1)(a) allows it to refuse to disclose information 
obtained in the course of its investigations. 


The information requested was collected while DIR was 
investigating a complaint under the Competition Act. 
Thus it was lawful to refuse disclosure. However, the 
Commissioner observed that the exempted information 
was relatively innocuous and the complainant probably 
already knew its substance. Yet, representations and 
reasoning failed to persuade CCA to disclose the 
information. It clung steadfastly to its right to refuse, 
despite there being no reasonable probability that giving 
the man the information would harm the investigation or 
any person. 


Since section 22(1){a) does not require CCA to satisfy 
an injury test, the Privacy Commissioner had to tell the 
complainant that—much as he disagreed with CCAs 
stand—it complied with the letter of the law. He had to 
find the complaint not well-founded. 


Ontario Workers’ Compensation files no longer 
“confidential” 


A lawyer complained that Health and Welfare Canada 
denied him access to 20 pages from his client’s Canada 
Pension Plan disability medical file which had originated 
with the Ontario Workers’ Compensation Board (VVCB). 


62 


At Health and Welfare’s suggestion, the lawyer applied 
directly to the WCB and received more material than 
Health and Welfare had exempted, leaving him unable to 
determine which documents Health and Welfare had 
used to deny his client's application. He argued that he 
could not properly represent his client in a pension 
appeal without knowing exactly which documents the 
department had received from the WCB. 


The investigator found that Health and Welfare had 
withheld 20 pages using section 19{1)(c) of the Privacy 
Act. This section requires federal institutions to exempt 
information supplied “in confidence” by provincial 
governments or their institutions. There is no flexibility 
or discretion. 


Thus, once a provincial or municipal government claims 
confidentiality, federal agencies may not disclose the 
information regardless of how innocuous it may be. 


The investigation confirmed that a December 14, 

1983, agreement provided that all information from the 
Ontario Workers' Compensation Board to Health and 
Welfare Canada was confidential and not to be disclosed 
except by the WCB itself. 


Despite the agreement, the investigator persuaded 
Health and Welfare to ask WCB officials for permission 
to release the material. Health and Welfare did so and, 
as a result, WCB changed its policy, authorizing Health 
and Welfare to release its information directly to 
applicants. Health and Welfare then disclosed the 
client’s material to the lawyer. 


This is an important policy change which should simplify 
the procedure for many applicants. 
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The Commissioner concluded that the complaint was 
not well-founded because Health and Welfare previously 
had no authority to release the VWCB's records. He 
applauded the change of position. 


Notifying the Commissioner 


Forty-three times this year the office was notified by 
government agencies that they intended to release 
personal information “in the public interest” or to 
“benefit” an individual. The Commissioner's role in this 
process is simply to notify the person if he considers it 
appropriate. He may advise against—but not prevent— 
the release. 


Staff examine these notices so that the Commissioner 
remains free to consider any complaints without having 
prejudged the disclosure. 


Although section 8(2)(m) of the Act is intended for 
exceptional disclosures, many notifications have become 
repetitive and something of an administrative burden for 
both the department and the Commissioner's office. 


For example, Multiculturalism and Citizenship routinely 
notifies the Commissioner when confirming the 
Canadian citizenship of nominees for the Order of 
Canada. Since this was a recurrent and routine use of 
citizenship documents, the office suggested the 
department acknowledge this publicly and change its 
listing in Info Source to describe this use of citizenship 
documents. The department agreed, eliminating 
paperwork for itself and providing the public a clearer 
picture of how citizenship information may be used. 
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Correctional Services disclosures—a reprise 


Last year the Commissioner reported on the difficult 
balance between individuals’ privacy and the public 
interest—particularly on the release of reports on two 
prison escapes during which three persons were 
murdered (see Annual Report 1990-91). 


The solicitor general refused to give the Justice and 
solicitor General Committee uncensored versions of the 
investigation reports, maintaining that the Privacy Act 
prohibited the disclosure. 


His refusal became the subject of a question of privilege 
in the House of Commons and the then-acting Privacy 
Commissioner was called to testify before the Privileges 
and Elections Committee. The acting Commissioner saw 
no difficulty with the solicitor general providing 
uncensored reports to an in camera committee 
hearing. 


The privileges committee report concluded “that there is 
nothing in the Privacy Act to prevent the House of 
Commons from issuing an order for the production of 
unexpurgated versions of the two reports. Accordingly, 
we do not believe that an amendment to the Privacy Act 
to permit such production is either necessary or 
desirable’. 


The report suggested making copies available to the 
Justice committee at an in camera meeting. 


The following are samples of other public interest 
notices received during the year. 
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Release prompts complaint to Commissioner 


The Privy Council Office (PCO) advised the office that it 
intended to disclose personal information about several 
individuals to a professional body inquiring into the 
conduct of two of its members. The documents had 
been produced in evidence before a federal commission 
of inquiry. | 


PCO had obtained the consent of one individual (who 
was not under investigation) but considered it 
impractical to obtain everyone's consent. The 
Commissioner's office believed that the individuals 
should be notified of the impending release but 
suggested that it would be less disturbing coming 
directly from PCO. Privy Council agreed and wrote to 
each person, setting out the reasons for disclosure and 
citing the permissive section in the Privacy Act. 


One of the professionals under investigation objected 
and has since complained to the Privacy Commissioner. 


Details released for possible bravery award 


The RCMP advised the Commissioner's office that the 
Chancellery of Canadian Orders and Decorations (in the 
Governor-General's Office) had asked the Force for 
information on one victim of a 1972 Arctic plane crash. 
The Chancellery was considering awarding a 
posthumous bravery decoration to a young Inuit man 
who survived the crash and kept the injured pilot alive 
but died before both could be rescued. 


The Chancellery was reconsidering the award following 


publication of a second book on the accident which 
detailed the young man’s role in the pilot's survival. 
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The privacy investigator examined the material that the 
RCMP proposed to release and found it contained less 
personal detail than the transcripts of a coroner’s 
inquest or either book on the crash. The proposed 
disclosure did verify the accuracy of some of the details 
in the book. 


The office did not object to the release and concluded it 
need not notify the sole survivor since the information 
was already public. 


Pilots and engineers list not released 


National Defence (DND) asked Transport Canada for a 
list of helicopter pilots and maintenance engineers in the 
Ottawa area to notify them of job opportunities at DND. 


The Commissioner's office is reluctant to support this 
type of wide-scale list disclosure when there are other 
means of communicating with the individuals. 
Disclosure might “benefit” those who got jobs, but not 
the other several hundred who did not. The office 
suggested Transport Canada mail notices for DND, or 
that DND simply place advertisements in local 
newspapers and professional journals. 


Transport Canada decided not to provide the list. 
Post-mortem to family doctor 


A doctor asked National Defence for the post-mortem of 
a military member who died suddenly while jogging. The 
doctor was treating a member of the man’s family and 
wanted to determine whether the officer had the same 
condition which could contribute to a heart attack. 

since the condition is suspected of being hereditary, the 
doctor wanted to begin immediate treatment of other 
family members. 
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DND released the post-mortem, then notified the 
Commissioner's Office. Although the Office prefers to 
be notified in advance, the request arrived during the 
public service strike when DND had no office staff. 
There was no objection to the disclosure. 


Korean veterans’ list to Rideau Hall 


The Governor General’s Office was the source of 
another request for personal information, this time 
about Korean War veterans. This notice provided a 
good example of how easily communications can 
become muddied over the telephone. 


The Chancellery asked Veterans Affairs Canada for 
access to its computer database containing personal 
information about veterans eligible for the Canadian 
Volunteer Service Medal for Korea. The personal 
details—names and addresses, language, service 
number and confirmation of eligibility—would speed 
processing of applications for the new Korean Var 
medal. The Governor General's office wanted to present 
the awards in November 19971. 


Veterans Affairs staff telephoned the Commissioner's 
office to discuss the request and were left with the 
impression that they would need written consent from 
each veteran. (In fact, consent was just one of the 
avenues suggested.) This message was conveyed to 
Chancellery staff who, understandably frustrated, called 
the offices directly. 
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Privacy staff asked to see a written notification and 
sample of the information to be taken from the 
database. Once they had examined material, it was 
apparent that everyone on the list had indicated an 
interest in the medal and therefore would benefit. Staff 
also suggested Veterans Affairs obtain a written 
undertaking that the Chancellery would use the data 
only for this purpose, then destroy it or return it to 
Veterans Affairs. 


The misunderstanding was cleared up quickly and the 
Governor General presented the first of the medals at a 
ceremony in Ottawa on November 10, 19971. 


False claim to Canadian citizenship 


External Affairs advised the Commissioner's Office that it 
proposed to tell a foreign government that a man 
arrested overseas on drug-related charges was not a 
Canadian citizen, even though he carried a Canadian 
passport. 


The foreign government had seized the passport and 
given it to External Affairs on the understanding that if 
indeed he were Canadian, Canada Would issue travel 
documents once the man was released. Since he was 
not a citizen, the Canadian embassy would not provide 
consular services or travel documents. 


The Commissioner's Office agreed to the disclosure 
because there is a significant public interest in the 
integrity of Canadian passports. And it is important that 
Canadians not be alarmed by reports of consular 
services being denied to “citizens” whose claims are 
actually false. 
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Inquiries—the Public Talks Back 


Inguiries officers continue to respond to an ever- 
mounting tide of letters and telephone calls—4,671 of 
them during the year. The offices’ national toll-free line 
(shared with the Information Commissioner) is the only 
nation-wide access and privacy information service. 


Canadians are becoming more aware of existing privacy 
protection, as well as new or proposed legislation 
governing provincial and municipal governments. 
Saskatchewan has just proclaimed its Freedom of 
Information and Privacy Act, and both British Columbia 
and Alberta have promised similar legislation in their 
latest throne speeches. 


However, callers are shocked to discover that the 
private sector remains totally unregulated. The office 
handles many calls from individuals faced with difficulties 
in examining or protecting their information held by 
private organizations. It is frustrating to confess that 
there is nothing the office can do since our jurisdiction 
is limited to the federal government. Even worse Is 
being unable to suggest a route to solve many callers’ 
problems. 


Although the Privacy Act is a federal law, hundreds of 
federally-regulated agencies and companies, and most 
Crown corporations, are “unregulated’"—including 
Canadian National Railways, Via Rail, Air Canada, 
Atomic Energy of Canada Limited, various ports 
corporations, telephone companies and financial 
institutions such as banks and insurance companies. 
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The office has also answered calls about handling 
personal information in MPs’ offices and at the Royal 
Commission on the New Reproductive Technologies. 
Employees and clients are dismayed to hear that we 
cannot intervene nor can they use provincial or 
municipal laws. 


A substantial part of the inquiries officers’ time is spent 
explaining the limited controls on use of Social Insurance 
Numbers (SIN). Most believe SIN use was restricted by 
the legislation which created unemployment and pension 
programs in the 1960s. Despite promises made at the 
time, that is not so. Many callers find it difficult to 
accept that only the federal government limits its use of 
SINs. 


Individuals too often must choose between protecting 
their SIN or getting the goods and services they want. 
Given our limited mandate, staff now encourage callers 
to write to their MPs in the hope that if more MPs hear 
the complaints, they might act to control unnecessary 
uses of the SIN. 


But the SIN story is not all gloom. Several organizations 
are interested in the SIN issue. During the past year. 
we sent background information to the Regional 
Municipality of Waterloo, the Ontario Ministry of 
Revenue, the Universities of Saskatchewan and Quebec, 
Nova Corporation and Maritime Telegraph and 
Telephone Company Ltd. 
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And there are kudos for the Quebec access and privacy 
commissioner’s office for investigating SIN abuses in 
Quebec government agencies. Unlike most provinces 
which avoid the issue because SIN is a federal number, 
the Quebec commission seized the initiative and 
intervened under its own access and privacy legislation. 
For example, Quebec no longer demands a SIN to get a 
fishing permit for provincially controlled areas. As well, | 
the automobile insurance industry has informally agreed 
to stop forcing clients to provide their SIN. 


And the Quebec commission is now examining other 
provincial uses of the SIN including: 


e Hydro-Québec’s authority to use the SIN to identify 
both employees and subscribers; 

e the Université de Laval’s collection of SIN from 
students; and 

e SIN use by hospitals, nursing homes and housing 
authorities. 


lt is encouraging to find that the federal government's 
efforts have had some impact outside its immediate 
jurisdiction. 


Despite efforts to fine-tune listings in the blue 
(government) pages of telephone directories, more than 
half of the calls on the national toll-free line are 
unrelated to access or privacy. The receptionist re- 
directed 93483 callers to Reference Canada, the federal 
government's central information service. The office will 
make another attempt now that Bell Canada and the 
government telephone authority are working to improve 
the blue pages. 


Finally, the office installed a device to communicate with 
callers with hearing or speech impediments (TDD). 
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The following two tables illustrate inquiries statistics. 
The first breaks out this year’s inquiries by subject and 
the second compares numbers with previous years. 


INQUIRIES 1991-92 
What is the Privacy Act and 
How Can | Use It’? 


No Jurisdiction/Outside Privacy Act 
(Federal, Provincial, Municipal & 
Private Sectors) 


Use & Abuse of the Social Insurance 
Number (SIN) 


Misdirected Applications & 
Unrelated Matters 


TOTAL 


2420 (52%) 


808 (17%) 


088 (13%) 


855 (18%) 


4671 
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Inquiries 1983-92 


6000 


cove 4 4671 


4000 ] 
3000 ] 


2000 


1008 1086 


904 


1000 


*83-84 84-85 85-86 86-87 87-88 88-89 89-90 90-91 91-92 


i 9 Months 
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Compliance Directorate 


The directorate had two objectives for 1991-92. The 
first was to focus on a complex national organization— 
Canada Mortgage and Housing—with significant 
electronic data processing and communications 
components. Auditing CMHC permitted staff to 
examine distributed data processing and electronic 
communication issues and to further develop our EDP 
audit methodology. 


The second objective was to review several smaller 
agencies dealing with women’s and minority rights. 
Most of these organizations have large personal 
information collections, often because they investigate 
complaints. Ve selected Status of Women Canada, 
Canadian Advisory Council on the Status of Women, the 
Canadian Human Rights Commission and the 
Immigration and Refugee Board. 


Audits were also completed on several other institutions 
such as National Defence, the National Capital 
Commission, Canadian Film Development Corporation, 
the Standards Council of Canada and various pilotage 
authorities. Work at 13 other organizations will carry 
over to 1992-93. Staff also 

° investigated five incidents of lost or stolen files; 

e audited three existing data-matches at Employment 

and Immigration Canada; and 

® conducted a government-wide survey on the use of 

upward or reverse appraisals in federal institutions. 


Trends and Problems 


The past year’s audits revealed some emerging trends 
in government information handling that demand 
attention. Foremost perhaps |s the federal 
government's increasing use of private sector 
companies to provide services which handle personal 
Information. 
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Contracting out—who’s minding the data? 


Budget pressures on government agencies have led 
many to use private industry for some of the services 
once performed in-house. For example, services such 
as Employee Assistance Programs, payroll applications 
and credit checking—and the personal information that 
goes with them—are now frequently handled by private 
companies under contract to the responsable 
government agencies. 


The office has no quarrel with private companies 
performing services. However, unlike the federal 
government, the private sector is not covered by the 
Privacy Act. Thus, personal files handed over to private 
firms get no formal privacy protection unless specific 
clauses are written into the contracts. Since some 
departments use standard Supply and Services Canada 
contract forms and others draft their own, there is little 
consistency. Nevertheless, almost without exception, 
the contracts are deficient. 


For example, contracts fail to: 


¢ define ownership of the information: 

* ensure employee access to the files: 

¢ restrict further use of the personal data; 

® protect against unauthorized disclosure; 

¢ ensure proper disposal of files at contract end; 

¢ establish retention and disposal criteria; and 

e ensure the department's ability to audit compliance. 


Our office is now working with Supply and Services 
Canada and Treasury Board to develop a standard 
contract. This should remedy many of the problems. 
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Checking employee credit ratings 


Compliance auditors have found collection problems 
during examinations of personnel files. All permanent 
government employees—and many of those transferred 
or promoted—must undergo reliability checks. The 
department or agency obtains candidates’ permission to 
check their credit ratings. Ratings are a combination of 
letters and numbers which describe the person’s 
relative debt load and repayment behaviour. 


The staff also found many of the same contracting 
problems described earlier. However, the credit 
checking process revealed other potential problems. 

For example, such large organizations as the RCMP 
Canada Mortgage and Housing and National Defence 
often have direct on-line access to credit bureaus, 
allowing them to obtain substantially more personal 
financial data than a simple credit rating. There 
appears to be potential for abuse and nothing to prevent 
institutions from going on fishing expeditions. 


In fact, most audited institutions tended to collect much 
more financial information than they needed. Details 
such as credit limits and account balances were found 
in files where only a simple credit rating was required. 
As well, the staff found credit reports containing not 
only the employee's information but also data on 
spouses. Credit bureaus often send out a work history 
and credit rating on the spouse, linking the information 
with the employee by Social Insurance Numbers and 
dates of birth. 
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Once in the hands of the government agency, credit 
information is often not kept secure. In some instances 
privacy staff found the information was transmitted by 
fax. In others, it was stored on the hard disk of desktop 
computers without adequate security protection. 


Finally, much credit information is unreliable and 
therefore government institutions may be relying on 
incorrect data. Independent studies reveal a high error 
rate in credit files. Updates and corrections are made 
slowly and—sometimes—not at all. The onus rests 
entirely with individuals, even though stores and banks 
transmit the information to the credit bureaus. 


Electronic transmission of personal information 


Privacy audits have also found that government 
institutions routinely fax personal information. This 
courts the risks of having the transmission intercepted 
or sent to the wrong location. For example, an 
employee at the Canada Employment Centre in Sarnia, 
Ontario, sent four individuals unemployment insurance 
queries to the local newspaper instead of the 
Employment and Immigration Canada office in London, 
Ontario. The employee had mistakenly punched the 
adjacent speed dial button which was programmed with 
the newspaper's number. 


The incident was simple human error but it 
demonstrated the possible consequences of faxing 
personal information—a procedure auditors found in 
almost every institution visited. Fax is one type of 
technology where policies and procedures are not 
keeping pace. Little thought is given to what information 
should or should not be sent by fax. Employees 
transmit personal information from the most innocuous 
(lists of participants at meetings) to the most sensitive 
(medical records and credit checks). 
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Similar difficulties arise with the new electronic mail (E- 
mail} systems now being widely implemented. E-mail 
programs allow users of computer networks to 
communicate and transfer data within the network. Yet 
there are few policies or procedures to ensure that the 
data are shared only with those who need to know, or 
that it all remains secure. 


Who's minding the computer? 


One disturbing trend is that government seems not to 
be applying the same standards of management and 
control to its EDP resources as it does its paper 
records. Large complex government institutions appear 
not to know what hardware and software they own, let 
alone who has access and how the systems are being 
used. Increasingly, major collections of personal records 
are being automated but without formal controls. 
Electronic files lend themselves easily to improper 
collection, use and disclosure but, because the data are 
out of sight, they appear to be out of mind. 


Portable computers: Automation of the federal 
government has seen the computer shrink from 
yesterday's roomful of equipment to today’s notebook- 
sized units (with as much or more power) tucked into a 
briefcase. And already being tested is integrated chip 
technology which makes the plastic card “smart’—a 
mini-computer capable of storing and processing 
information. 


However, these personal computing devices demand 
new management and control systems. Users often 
forget that these are not merely miniature typewriters. 
Computers remember what they process. Their loss or 
theft means not only lost valuable equipment but also 
lost information. 
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The office investigation this year of the theft of a 
personal computer from the Montreal office of Veterans 
Affairs illustrates the seriousness of such an incident. 
The computer was part of a new system on trial. It had 
been loaded with tombstone data on the office's entire 
20,000 client base. Fortunately the personal details 
were very limited and the Commissioner decided not to 
notify the individuals concerned. 


The investigation made it clear that Veterans Affairs 
staff had not followed the department's procedures for 
protecting valuable property. More important, however, 
investigators found no policies and procedures covering 
the storage and protection of the personal data in the 
computer memory. The Commissioner recommended 
that Veterans Affairs develop those policies and 
consider restricting storage of personal data to 
diskettes which could be removed and stored 
separately. Alternatively, personal data on personal 
computers could be encrypted to make it inaccessible to 
unauthorized users. 


Controlling access in networks: [he marriage of 
microcomputers and local or wide area networks poses 
another privacy challenge: determining which users 
should have access to what data. Auditors often find 
that authorized system users frequently can access 
information they do not need. The physical premises 
and the computer system may be secure from external 
threats but, once into the system, authorized users may 
access any data. Systems are needed to restrict users 
to the information they need to know. 
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Ending the pack rat syndrome: Auditors find few 
retention and disposal schedules for EDP files and those 
that do exist often do not correspond to the schedules 
for the paper files. Government may be shredding its 
paper but much of that paper was generated 
electronically. The data are replicated on hard and soft 
disks that seem to be kept indefinitely. Government 
agencies managing the retention and disposal of 
personal files need also to examine the electronic 
versions. 


Describing information holdings 


The description of government information holdings in 
Info Source continues to concern the Commissioner. 
Lack of resources may be a contributing factor but 
auditors find that Info Source is an incomplete and 
sometimes inaccurate catalogue of personal information 
held by government institutions. Some departments 
seem not to have a clear understanding of what they 
should list or how to change listings. 


A common problem is the failure to list such federal 
employee standard banks as leave and attendance, 
travel and relocation, and training and development. 
The reverse is sometimes true—standard banks are 
listed but the institution holds no information. In fact, 
the bank is empty. And occasionally auditors and 
complaints investigators stumble upon information that 
seems not to be listed at all. 


It may be time for Treasury Board to set out more 
clearly what institutions should describe and how to 
make changes. Also needed is a more rigorous review 
of the input government institutions provide to /nfo 
Source. 
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Upward appraisals 


In earlier reports, the Privacy Commissioner expressed 
concern about the anonymity feature of upward or 
reverse appraisal processes being conducted in some 
departments. This process allows employees to rate 
and comment on their manager's performance, often 
anonymously. 


In an effort to establish just how widespread the upward 
appraisal process has become and how it is being done, 
the Compliance Directorate polled 148 departments 
and agencies covered by the Privacy Act. At this writing 
it had received 141 responses (eight from one 
department), 27 of which were using or planning to use 
the process within the next 12 months. Of these 27, 
24 promise employees anonymity and 18 use private 
consultants to analyze the results. 


So fewer than 20 per cent of government agencies 
have embraced the idea. Nevertheless, one questions 
Canada’s public service lending itself to a personnel 
relations process which relies upon the use of 
anonymous informants. 
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Corporate Management Branch 


Corporate Management provides both the Privacy and 
Information Commissioners’ offices with financial, administrative 
informatics and library services. 


The following are the offices’ expenditures 
for the period April 1, 1991, to March 31, 1992. * 


Corporate 
Information Privacy Management Total 

Salaries 1,670,069 1,911,442 658,825 4,240,336 
Employee Benefit 
Plan Contributions 285,600 307,020 121,380 714,000 
Transportation and 
Communication 70,021 59,500 124,875 259,996 
nformation 21,005 55,261 3,109 79,375 
°>rofessional and 
Special Services 209,028 190,237 81,059 480,324 
Rentals | 4,391 3)2/6 11,945 19,612 
-urchased Repair and 
Maintenance 6,688 6,358 7,199 20,245 
Jtilities, Materials 
and Supplies 18,692 9,814 29,070 77,070 
Acquisition of Machinery 
and Equipment 109,474 44,361 12,959 166,794 
Ither Payments 2,970 1,873 250 5,093 

TOTAL 2,403,538 2,589,142 1,050,671 6,043,351 


‘ Expenditure figures do not incorporate final year-end adjustments reflected in 
the offices’ 1991-92 Public Accounts. 
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Finance 


The offices’ total resources for the 1991-92 fiscal year 
were $6,691,000 and 82 person-years, an increase of 
$367,000 and four person-years over 1990-91. 
Personnel costs of $4,954,336 and professional and 
special services expenditures of $480,324 accounted 
for more than 9O per cent of expenditures. The 
remaining $608,691 covered all other expenses. 


Personnel 


In the spirit of PS 2000, the unit made several 
improvements to the offices’ personnel management 
practices by recruiting a management trainee, 
developing incentive awards and an orientation program 
for new employees, and streamlining some of Its 
personnel procedures. In addition, the unit conducted a 
triennial classification audit, followed up the 1987 
official languages audit and signed a letter of 
understanding on official languages with the Treasury 
Board. 


Administration 

The unit made continued progress on a retention and 
disposal schedule for records and also on an automated 
inventory of assets. As well, it evaluated the offices’ 
telephone system to improve service to the public. 
Informatics 

This year the unit completed three studies for a new 


case management system, office automation and using 
a computer network in a secure environment. 
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Library 


The library provides interlibrary loan services, manual 
and automated reference and research, and subject- 
oriented media monitoring files. In addition to acquiring 
information on freedom of information, the right to 
privacy, data protection and the ombudsman function, 
the library has a special collection of Canadian and 
international ombudsmen’s reports and departmental 
annual reports on the administration of the two acts. 


The library (which is open to the public) handled 1,298 
publication requests and answered 1,084 reference 
questions during the year. 
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Organization Chart 
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